Gogs, an open‑source self‑hosted Git service, contains a stored cross‑site scripting flaw that arises from unsafe template rendering. The vulnerability allows an attacker to inject malicious JavaScript into branch and wiki pages by forging author or committer names in a repository commit. When a user views those pages the script executes in the context of their browser.

All installations of Gogs older than version 0.14.2 are affected. The fix was introduced in release 0.14.2; earlier releases remain vulnerable. No specific platform or OS constraints are noted beyond the requirement that the application be running the vulnerable Gogs build.

The CVSS score is 6.9, indicating a medium severity flaw, and the EPSS score is below 1 %, suggesting a low likelihood of exploitation at the time of assessment. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that exploitation requires write access to a repository to set a malicious author or committer name; the script then runs in the context of users accessing the affected branch or wiki page.