Is CVE-2026-59102 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-59102 being exploited in the wild.

How severe is CVE-2026-59102?

Medium severity, with a CVSS score of 5.4, published 2 July 2026.

Is there a fix for CVE-2026-59102?

A patch was published on 2026-06-10: Security patches merged into v15.0 branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-59102 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-59102?

Check whether you run Forgejo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-59102: Forgejo stored XSS in Actions run page via user full name

CVE-2026-59102 · Severity: medium · CVSS 5.4 · Published 2026-07-02

Forgejo is a self-hosted software development platform similar to GitHub. A security flaw in the Actions component allows a logged-in user to inject malicious scripts into the platform by changing their profile name. If an administrator or another user views the activity logs for a project where this user has contributed, the malicious script could execute in their browser, potentially leading to unauthorized actions or data theft.

Technologies: Forgejo. Vendors: Forgejo.

Quick answers

Is CVE-2026-59102 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-59102 being exploited in the wild.
How severe is CVE-2026-59102?: Medium severity, with a CVSS score of 5.4, published 2 July 2026.
Which products and versions are affected?: Forgejo < 15.0.3.
Is there a fix for CVE-2026-59102?: A patch was published on 2026-06-10: Security patches merged into v15.0 branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-59102 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-59102?: Check whether you run Forgejo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stored cross-site scripting (XSS) vulnerability exists in Forgejo's Actions run view. When the 'DEFAULT_SHOW_FULL_NAME' option is enabled in app.ini, the 'GetDisplayName()' function returns the user's raw FullName without sanitization. This value is interpolated into an HTML-bearing locale format string (e.g., 'on_push_description') server-side. The resulting string is then rendered in the Vue.js frontend using a 'v-html' binding, which executes any embedded JavaScript. An authenticated attacker can exploit this by setting their full name to a malicious payload and triggering an Actions run (e.g., via a git push). The script executes when any user views the affected Actions run page. This issue is fixed in version 15.0.3 by applying HTML escaping to the display name before interpolation.

Affected products

Forgejo Forgejo < 15.0.3

Timeline

2026-05-22: disclosed: Vulnerability reported to maintainers via email
2026-06-10: patched: Security patches merged into v15.0 branch
2026-07-02: advisory: CVE-2026-59102 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.