5.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-68942

CVE-2025-68942: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text

Gitea before 1.22.2 allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-68942

CVE-2025-68942:

5.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
code.gitea.io/gitea	go	< 1.22.2	1.22.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the provided information, specifically the pull request and commit details, points to a clear Cross-Site Scripting (XSS) vulnerability in a Vue.js component. The commit 5b5eb352156dd7688148031bfa0268c9c6edae7b from the pull request https://github.com/go-gitea/gitea/pull/31966 contains the security fix. The vulnerability existed in the web_src/js/components/RepoBranchTagSelector.vue file. The patch shows that the v-html directive, which renders raw HTML, was being used to display a search term provided by the user (searchTerm). This is a classic XSS vulnerability, as it allows an attacker to inject script tags or other malicious HTML. The fix involves replacing v-html with v-text, which ensures the user input is treated as plain text and not interpreted as HTML, thus mitigating the vulnerability. The vulnerable component is RepoBranchTagSelector, and this is where the exploitation would occur in the application's frontend.

Vulnerable functions

RepoBranchTagSelector

web_src/js/components/RepoBranchTagSelector.vue

The `RepoBranchTagSelector` Vue component was vulnerable to XSS. It used the `v-html` directive to render the `searchTerm` variable, which holds user input from the search box for creating branches or tags. This allowed an attacker to inject malicious HTML and JavaScript into the page by crafting a malicious search term. The patch replaces the insecure `v-html` with `v-text`, which properly sanitizes the user input by rendering it as plain text.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.