5.4

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-52816

CVE-2026-52816: Gogs: Unauthenticated Jupyter Notebook (ipynb) Sanitizer allows arbitrary data: URIs leading to XSS

Gogs is an open source self-hosted Git service. Prior to 0.14.3, the Jupyter Notebook (ipynb) sanitizer endpoint at POST /-/api/sanitize_ipynb allows arbitrary data: URIs without proper restrictions, potentially leading to Cross-Site Scripting (XSS). The endpoint uses bluemonday.UGCPolicy() with p.AllowURLSchemes("data") which permits all data URI schemes including data:text/html, enabling attackers to inject malicious HTML/JavaScript. Additionally, the endpoint has no authentication middleware, allowing any registered user to exploit this vulnerability. This vulnerability is fixed in 0.14.3.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-52816

CVE-2026-52816:

5.4

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
gogs.io/gogs	go	< 0.14.3	0.14.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the ipynbSanitizer function in internal/app/api.go. This function was responsible for creating a policy to sanitize Jupyter Notebook files. The policy incorrectly allowed all data: URI schemes by using p.AllowURLSchemes("data"). This oversight permitted an attacker to embed malicious HTML and JavaScript within a data: URI (e.g., data:text/html,<script>alert(1)</script>). When the Gogs server processed a crafted .ipynb file, the sanitizer would fail to remove the malicious data: URI, leading to a stored Cross-Site Scripting (XSS) vulnerability. The fix, as seen in the commit dd1bd9837aa196b3ed3a8ee21e5727b5d7a986a3, was to replace the overly permissive rule with p.AllowURLSchemeWithCustomPolicy("data", markup.IsSafeDataURI), which restricts data: URIs to a whitelist of safe image MIME types, thus preventing the XSS attack.

Vulnerable functions

gogs.io/gogs/internal/app.ipynbSanitizer

internal/app/api.go

The function `ipynbSanitizer` creates a bluemonday policy for sanitizing Jupyter notebooks. The original implementation used `p.AllowURLSchemes("data")`, which allowed any `data:` URI, including malicious `data:text/html,...` payloads. This could be exploited for Cross-Site Scripting (XSS) because the sanitization endpoint was unauthenticated. An attacker could craft a malicious ipynb file with a `data:` URI containing JavaScript, and when a user views the sanitized notebook, the script would execute in their browser.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.