Forgejo versions earlier than 15.0.3 allow an authenticated user to store an arbitrary JavaScript payload in their full name and trigger an Actions run that merges the name into an HTML string rendered server‑side. When DEFAULT_SHOW_FULL_NAME is enabled, the run description is assembled with the user’s display name interpolated into a Vue v-html binding without proper escaping, which results in client‑side script execution for any user who views the run page. The ability to execute arbitrary JavaScript in other users’ browsers enables client‑side attacks such as phishing or credential theft; these outcomes are inferred from the vulnerability’s impact rather than explicitly stated in the documentation.

All installations of Forgejo (forgejo:forgejo) with a version earlier than 15.0.3 and with the DEFAULT_SHOW_FULL_NAME option set to true are impacted. No other product variants or versions are listed. The vulnerability affects the full user name rendering logic used by the Actions run feature.

The CVSS score of 2.1 reflects the need for user authentication and a configuration setting. Exploitation requires the attacker to set a malicious full name, create an Actions run, and wait for or entice other users to view the run page; based on this description, it is inferred that the attacker could cause client‑side code execution that might lead to phishing or session hijacking. The EPSS score of < 1 % indicates a very low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog, which together suggest that the overall risk is low but not negligible.