A DOM‑based XSS flaw in Gogs allows an attacker to embed an HTML or JavaScript payload into the title of a repository milestone. When another user selects that milestone on the New Issue page, the payload is injected into the page’s DOM and executes in the victim’s browser. The weakness is a classic unvalidated stored input reflected unsanitized content, identified as CWE‑79. The impact is that any authenticated or publicly accessible user who views the milestone can have arbitrary JavaScript run in their browser session, potentially leading to session hijacking, credential theft, or point‑of‑interest defacement.

Gogs, versions older than 0.14.2. The issue was fixed in v0.14.2, so any deployment using v0.14.1 or earlier is affected.

The CVSS score of 7.3 places this vulnerability in the high‑severity range, though the EPSS score of less than 1% indicates a low probability of exploitation currently. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires an attacker to create a milestone with malicious content in a repository they can modify, after which any user who selects that milestone on the issue creation page is exposed to the injected JavaScript. Because the flaw requires only repository modification privileges, an internal user or an attacker who gains write access to the repository can trigger it. Despite the low exploitation probability, the potential for damaging session compromise warrants immediate remediation.