8.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-52798

CVE-2026-52798: Gogs: Stored XSS in `.ipynb` Preview

Gogs is an open source self-hosted Git service. Prior to 0.14.3, although .ipynb previews are sanitized on the server side via /-/api/sanitize_ipynb, the inserted content is re-rendered on the client side without sanitization using marked() on elements with the .nb-markdown-cell class. During this process, links containing schemes such as javascript: can be regenerated. As a result, when a victim views an attacker-crafted .ipynb file and clicks the link, arbitrary JavaScript is executed in the Gogs origin, leading to a click-based Stored XSS. This vulnerability is fixed in 0.14.3.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-52798

CVE-2026-52798:

8.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable NoTech Impact Total

Select your environment

→SSVCScheduled60 days

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
gogs.io/gogs	go	<= 0.14.2	0.14.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the provided security advisory and the associated commit 17b168b11ca759a7550e1f4bbd68bbde14db7785 clearly indicates a stored XSS vulnerability in the client-side rendering of .ipynb files. The vulnerability is not in a Go function but in the inline JavaScript within the templates/repo/view_file.tmpl Go template.

The root cause is the re-rendering of server-sanitized content on the client side using the marked() JavaScript library without proper configuration for URL sanitization. The patch confirms this by:

Upgrading the marked.js library from version 0.8.1 to 4.3.0.
Introducing a custom renderer.link function that explicitly checks for and neutralizes malicious URL schemes (e.g., javascript:).

The vulnerable code is located within the success callback of a jQuery $.getJSON call, which is triggered when a user views a .ipynb file. This callback processes the notebook's markdown cells, and the line $(markdown).html(marked($(markdown).html(), {renderer: renderer})); is where the unsanitized rendering occurs. An attacker could craft a malicious .ipynb file with a javascript: link, and any user viewing this file and clicking the link would execute the script in their browser, in the context of the Gogs domain.

Vulnerable functions

$.getJSON.callback

templates/repo/view_file.tmpl

The vulnerability exists in an anonymous JavaScript function within the `view_file.tmpl` template, which is used to render Jupyter notebooks (`.ipynb`). This function is a callback for a `$.getJSON` request that fetches the notebook content. Inside this callback, the code iterates through each markdown cell (`.nb-markdown-cell`) and re-renders its content using the `marked()` library. The original code did not sanitize the `href` attribute of links during this client-side rendering process. This allowed an attacker to embed a `javascript:` URL in a markdown link, leading to a stored Cross-Site Scripting (XSS) vulnerability when a victim clicks the crafted link. The patch introduces a custom link renderer that sanitizes URLs by checking for and blocking dangerous schemes like `javascript:`, `vbscript:`, and `data:`.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.