~ / search / GHSA-hq57-c72x-4774

GHSA-hq57-c72x-4774

Gitea vulnerable to Cross-site Scripting

Source: GitHub Advisory Database (reviewed) Moderate CVE-2025-68946

Packages

EcosystemPackageAffectedFixed in
Go code.gitea.io/gitea < 1.20.1 1.20.1

Details

As written in the advisory (Markdown source, shown as plain text).

In Gitea before 1.20.1, a forbidden URL scheme such as javascript: can be used for a link, aka XSS.

References

External links from the advisory. They lead to third-party sites.