GHSA-xq4v-vrp9-vcf2

Cross-site Scripting vulnerability in repository issue list in Gogs

Source: GitHub Advisory Database (reviewed) Moderate CVE-2022-31038

Packages

Ecosystem	Package	Affected	Fixed in
Go	gogs.io/gogs	< 0.12.9	0.12.9

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact `DisplayName` allows all the characters from users, which leads to an XSS vulnerability when directly displayed in the issue list. ### Patches `DisplayName` is sanitized before being displayed. Users should upgrade to 0.12.9 or the latest 0.13.0+dev. ### Workarounds Check and update the existing users' display names that contain malicious characters. ### References N/A ### For more information If you have any questions or comments about this advisory, please post on https://github.com/gogs/gogs/pull/7009.

References

External links from the advisory. They lead to third-party sites.

https://github.com/gogs/gogs/security/advisories/GHSA-xq4v-vrp9-vcf2 web
https://nvd.nist.gov/vuln/detail/CVE-2022-31038 advisory
https://github.com/gogs/gogs/pull/7009 web
https://github.com/gogs/gogs/commit/155cae1de8916fc3fde78f350763034b7422caee web
https://github.com/gogs/gogs package
https://github.com/gogs/gogs/releases/tag/v0.12.9 web