CVE-2026-52816: Gogs

Medium severity, CVSS 5.4. EPSS: 0.7% chance of exploitation in the next 30 days.

Gogs is an open source self-hosted Git service. Prior to 0.14.3, the Jupyter Notebook (ipynb) sanitizer endpoint at POST /-/api/sanitize_ipynb allows arbitrary data: URIs without proper restrictions, potentially leading to Cross-Site Scripting (XSS). The endpoint uses bluemonday.UGCPolicy() with p.AllowURLSchemes("data") which permits all data URI schemes including data:text/html, enabling attackers to inject malicious HTML/JavaScript. Additionally, the endpoint has no authentication middleware, allowing any registered user to exploit this vulnerability. This vulnerability is fixed in 0.14.3.

Affected products

• Gogs Gogs: before 0.14.3 (fixed in 0.14.3)

Published 2026-06-24. Last modified 2026-06-25.