Description
Gogs is an open source self-hosted Git service. Prior to 0.14.3, the Jupyter Notebook (ipynb) sanitizer endpoint at POST /-/api/sanitize_ipynb allows arbitrary data: URIs without proper restrictions, potentially leading to Cross-Site Scripting (XSS). The endpoint uses bluemonday.UGCPolicy() with p.AllowURLSchemes("data") which permits all data URI schemes including data:text/html, enabling attackers to inject malicious HTML/JavaScript. Additionally, the endpoint has no authentication middleware, allowing any registered user to exploit this vulnerability. This vulnerability is fixed in 0.14.3.
Published: 2026-06-24
Score: 5.4 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability lies in Gogs’ Jupyter Notebook sanitizer endpoint, which accepts data: URIs without restricting the scheme. The endpoint is publicly reachable and requires no authentication, allowing any registered user to submit payloads. Attackers can embed malicious HTML or JavaScript through data:text/html URIs, resulting in cross‑site scripting when the notebook is displayed in the browser, compromising confidentiality and integrity for end‑users.

Affected Systems

The issue affects all Gogs installations running a version earlier than 0.14.3. The product is the Gogs self‑hosted Git service, with the vulnerable endpoint at POST /-/api/sanitize_ipynb.

Risk and Exploitability

The CVSS score of 5.4 indicates a moderate severity. Exploitation is straightforward because the endpoint is unauthenticated and accepts arbitrary data URI schemes; no additional credentials are required. The vulnerability is not listed in CISA KEV and no EPSS score is available, implying limited documented exploitation. Nonetheless, the presence of XSS through a public API makes it a condition worth addressing promptly.

Generated by OpenCVE AI on June 24, 2026 at 21:28 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Gogs to version 0.14.3 or later, which removes the data URI scheme from the sanitizer endpoint.
  • If an immediate upgrade is not possible, place a reverse proxy or firewall rule that requires authentication or IP‑whitelisting before requests reach the /-/api/sanitize_ipynb endpoint.
  • After applying the fix or restriction, review custom notebook rendering logic to ensure no residual data URIs are processed before display.

Generated by OpenCVE AI on June 24, 2026 at 21:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-3w28-36p9-w929 Gogs's Unauthenticated Jupyter Notebook (ipynb) Sanitizer allows arbitrary data: URIs leading to XSS
History

Wed, 24 Jun 2026 20:30:00 +0000

Type Values Removed Values Added
Description Gogs is an open source self-hosted Git service. Prior to 0.14.3, the Jupyter Notebook (ipynb) sanitizer endpoint at POST /-/api/sanitize_ipynb allows arbitrary data: URIs without proper restrictions, potentially leading to Cross-Site Scripting (XSS). The endpoint uses bluemonday.UGCPolicy() with p.AllowURLSchemes("data") which permits all data URI schemes including data:text/html, enabling attackers to inject malicious HTML/JavaScript. Additionally, the endpoint has no authentication middleware, allowing any registered user to exploit this vulnerability. This vulnerability is fixed in 0.14.3.
Title Gogs: Unauthenticated Jupyter Notebook (ipynb) Sanitizer allows arbitrary data: URIs leading to XSS
Weaknesses CWE-80
References
Metrics cvssV4_0

{'score': 5.4, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:P'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-06-24T20:26:34.151Z

Reserved: 2026-06-08T18:11:06.660Z

Link: CVE-2026-52816

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-24T21:30:04Z

Weaknesses
  • CWE-80

    Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)