Executive brief
Forgejo is a self-hosted software development platform similar to GitHub. A security flaw in the Actions component allows a logged-in user to inject malicious scripts into the platform by changing their profile name. If an administrator or another user views the activity logs for a project where this user has contributed, the malicious script could execute in their browser, potentially leading to unauthorized actions or data theft.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in Forgejo's Actions run view. When the 'DEFAULT_SHOW_FULL_NAME' option is enabled in app.ini, the 'GetDisplayName()' function returns the user's raw FullName without sanitization. This value is interpolated into an HTML-bearing locale format string (e.g., 'on_push_description') server-side. The resulting string is then rendered in the Vue.js frontend using a 'v-html' binding, which executes any embedded JavaScript. An authenticated attacker can exploit this by setting their full name to a malicious payload and triggering an Actions run (e.g., via a git push). The script executes when any user views the affected Actions run page. This issue is fixed in version 15.0.3 by applying HTML escaping to the display name before interpolation.
Affected products
- Forgejo Forgejo < 15.0.3
Timeline
- 2026-05-22: disclosed: Vulnerability reported to maintainers via email
- 2026-06-10: patched: Security patches merged into v15.0 branch
- 2026-07-02: advisory: CVE-2026-59102 published