Milestone names are stored in the database and rendered in the New Issue page template using Go’s auto‑escaping. When the page is displayed, the browser creates a DOM element containing the milestone name. Semantic UI’s dropdown component, which defaults to preserveHTML:true, re‑parses that text as HTML and executes any injected script attached to event handlers. An attacker can therefore store a malicious payload in a milestone name and cause arbitrary JavaScript to run in the context of any user who opens the page and selects the milestone, potentially allowing session hijacking, credential theft, or defacement.

The vulnerability affects the open‑source Gogs Git service, specifically versions prior to 0.14.3 (0.14.0 through 0.14.2). The affected product is the gogs:gogs implementation of the self‑hosted Git server.

The CVSS score of 4.8 indicates moderate severity, but the flaw can be abused if an attacker can control or influence milestone names. EPSS data is unavailable, and the vulnerability is not listed in CISA’s KEV catalog. The attack requires user interaction with the New Issue page and a functional Semantic UI front‑end. Because the victim’s browser renders the malicious payload, the impact is limited to the victim session and does not provide direct control over the server or other users. Nonetheless the ease of exploitation in a web UI poses a real risk for unintended script execution and cross‑site data theft.