CVE-2026-52816: Gogs.io/gogs Cross-Site Scripting Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-3w28-36p9-w929",
  "modified" : "2026-07-21T13:17:20Z",
  "published" : "2026-06-23T17:33:32Z",
  "aliases" : [ "CVE-2026-52816" ],
  "summary" : "Gogs's Unauthenticated Jupyter Notebook (ipynb) Sanitizer allows arbitrary data: URIs leading to XSS",
  "details" : "## Summary\n\nThe Jupyter Notebook (ipynb) sanitizer endpoint at `POST /-/api/sanitize_ipynb` allows arbitrary `data:` URIs without proper restrictions, potentially leading to Cross-Site Scripting (XSS). The endpoint uses `bluemonday.UGCPolicy()` with `p.AllowURLSchemes(\"data\")` which permits all data URI schemes including `data:text/html`, enabling attackers to inject malicious HTML/JavaScript. Additionally, the endpoint has no authentication middleware, allowing any registered user to exploit this vulnerability.\n\n## Severity\n\n**High**\n\n## Affected Versions\n\nAll versions using the vulnerable endpoint\n\n## Vulnerability Details\n\n- **CVE ID**: (To be assigned)\n- **Entry Point**: `POST /-/api/sanitize_ipynb`\n- **Attack Vector**: Network\n- **Authentication Required**: No (only needs a registered user account)\n\n## Impact\n\nAn attacker with a registered user account can:\n\n- Send malicious HTML containing `data:text/html` URIs to the sanitization endpoint\n- Receive sanitized but attacker-controlled HTML in the response\n- Execute arbitrary JavaScript in the attacker's browser context through XSS\n- Potentially exploit other users if the sanitized output is rendered in their context\n\nThe vulnerability has higher severity because:\n\n1. No authentication required (only needs a registered user account)\n2. Unlike the safer pattern in `internal/markup/sanitizer.go:39` which uses `isSafeDataURI` to only allow safe image MIME types, this endpoint allows ALL data URIs including HTML\n3. The returned HTML can be used to craft XSS attacks\n\n## Proof of Concept\n\nAttacker sends a POST request to the sanitization endpoint:\n\n```http\nPOST /-/api/sanitize_ipynb HTTP/1.1\nHost: target.gogs.instance\nContent-Type: text/plain\n\n<a href=\"data:text/html,<script>alert(document.cookie)</script>\">click</a>\n```\n\nThe server returns the sanitized HTML with the data URI preserved:\n\n```html\n<a href=\"data:text/html,<script>alert(document.cookie)</script>\">click</a>\n```\n\nWhen this HTML is rendered in a browser, the JavaScript within the data URI will execute, leading to XSS.\n\n## Affected Component\n\n**File**: `internal/app/api.go:10-16`\n\n```go\nfunc ipynbSanitizer() *bluemonday.Policy {\n\tp := bluemonday.UGCPolicy()\n\tp.AllowAttrs(\"class\", \"data-prompt-number\").OnElements(\"div\")\n\tp.AllowAttrs(\"class\").OnElements(\"img\")\n\tp.AllowURLSchemes(\"data\")  // <-- VULNERABLE: allows all data URIs\n\treturn p\n}\n```\n\n**File**: `cmd/gogs/web.go:681-683` - No authentication middleware\n\n```go\nm.Group(\"/-\", func() {\n\tm.Get(\"/metrics\", app.MetricsFilter(), promhttp.Handler())\n\tm.Group(\"/api\", func() {\n\t\tm.Post(\"/sanitize_ipynb\", app.SanitizeIpynb())  // <-- No auth middleware\n\t})\n})\n```\n\n## Root Cause\n\n1. **Unrestricted data URI scheme**: The code at `internal/app/api.go:14` uses `p.AllowURLSchemes(\"data\")` without any restriction, unlike the safer implementation in `internal/markup/sanitizer.go:39` which uses `AllowURLSchemeWithCustomPolicy(\"data\", isSafeDataURI)` to only allow safe image MIME types.\n\n2. **No authentication**: The endpoint at `cmd/gogs/web.go:682` does not have any authentication middleware applied, making it accessible to any registered user.\n\n3. **Insufficient validation**: The sanitization only removes dangerous tags/attributes but preserves data URIs, allowing `data:text/html` payloads to pass through.\n\n## Suggested Fix\n\n**Option 1**: Use the same safe pattern as `internal/markup/sanitizer.go`\n\nReplace `p.AllowURLSchemes(\"data\")` with:\n\n```go\np.AllowURLSchemeWithCustomPolicy(\"data\", isSafeDataURI)\n```\n\nWhere `isSafeDataURI` is a function that only allows safe image MIME types (image/png, image/jpeg, image/gif, etc.).\n\n**Option 2**: Add authentication middleware\n\nApply appropriate authentication to the endpoint:\n\n```go\nm.Post(\"/sanitize_ipynb\", middleware.signIn, app.SanitizeIpynb())\n```\n\n**Option 3**: Disable data URI scheme entirely\n\nIf data URIs are not required for ipynb sanitization:\n\n```go\n// Remove this line entirely:\n// p.AllowURLSchemes(\"data\")\n```",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:P"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "gogs.io/gogs"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "0.14.3"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/gogs/gogs/security/advisories/GHSA-3w28-36p9-w929"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-52816"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/gogs/gogs/pull/8326"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/gogs/gogs/commit/dd1bd9837aa196b3ed3a8ee21e5727b5d7a986a3"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/gogs/gogs"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/gogs/gogs/releases/tag/v0.14.3"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-79", "CWE-80" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-06-23T17:33:32Z",
    "nvd_published_at" : "2026-06-24T21:16:57Z"
  }
}