Executive brief
Gogs is an open-source self-hosted Git service used by developers to manage source code. A security flaw in how the platform previews Jupyter Notebook (.ipynb) files allows an attacker to embed malicious code within a file. If a user views a specially crafted notebook and clicks a link within it, the attacker can execute commands in the user's browser, potentially leading to account takeover, data theft, or unauthorized repository changes.
Technical details
A Stored Cross-Site Scripting (XSS) vulnerability exists in Gogs' handling of Jupyter Notebook (.ipynb) previews. While the server-side sanitization via '/-/api/sanitize_ipynb' correctly filters initial input, the application subsequently re-renders Markdown cells on the client side using the 'marked()' library on elements with the '.nb-markdown-cell' class. This client-side re-rendering process fails to re-sanitize the content, allowing 'javascript:', 'vbscript:', or 'data:' URI schemes to be regenerated into clickable links. An attacker with repository write access can commit a malicious .ipynb file; when a victim views the file and clicks the link, arbitrary JavaScript executes within the Gogs origin. The issue was addressed in version 0.14.3 by upgrading 'marked.js' to version 4.3.0 and implementing a URL scheme blocklist.
Affected products
- Gogs Gogs < 0.14.3
Timeline
- 2026-06-04: patched: Fix merged into main branch
- 2026-06-07: advisory: Release 0.14.3 published
- 2026-06-24: disclosed: CVE-2026-52798 published to NVD