5.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-68946

CVE-2025-68946: Gitea vulnerable to Cross-site Scripting

In Gitea before 1.20.1, a forbidden URL scheme such as javascript: can be used for a link, aka XSS.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-68946

CVE-2025-68946:

5.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
code.gitea.io/gitea	go	< 1.20.1	1.20.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, a Cross-site Scripting (XSS) issue in Gitea, allows the use of forbidden URL schemes like javascript:. The analysis began by examining the provided pull request, which contains the security patch. The commits within the pull request were retrieved and analyzed. The key change was identified in commit 91bbc452a5d7e9ef7eeddbe7bbb40d9b17a42b71, specifically in the file modules/markup/sanitizer.go. This commit modifies the createDefaultPolicy function to explicitly disallow the javascript, vbscript, and data URL schemes, even when the application is configured to allow any other URL scheme. This function is responsible for generating the sanitization policy. The vulnerability existed because this function failed to blacklist these inherently unsafe schemes in all cases. Therefore, markup.createDefaultPolicy is identified as the vulnerable function, as it contained the logic flaw that was corrected by the patch.

Vulnerable functions

markup.createDefaultPolicy

modules/markup/sanitizer.go

The `createDefaultPolicy` function is responsible for creating the HTML sanitization policy used across Gitea. Before the patch, if the configuration allowed all URL schemes (using a wildcard), it did not explicitly block dangerous schemes like `javascript:`, `vbscript:`, and `data:`. This oversight allowed for the injection of malicious code within links, leading to a Cross-site Scripting (XSS) vulnerability. The patch rectifies this by adding a custom policy function that always denies these specific schemes, even when a permissive configuration is in place.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.