# CVE-2026-59102: Forgejo stored XSS in Actions run page via user full name

Source: https://junglewise.ai/threats/cve-2026-59102-forgejo-stored-xss-in-actions-run-page-via-user-full-name  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-02. Updated: 2026-07-02  
License: CC BY 4.0 with a link back

CVE-2026-59102 · Severity: medium · CVSS 5.4 · Published 2026-07-02

Forgejo is a self-hosted software development platform similar to GitHub. A security flaw in the Actions component allows a logged-in user to inject malicious scripts into the platform by changing their profile name. If an administrator or another user views the activity logs for a project where this user has contributed, the malicious script could execute in their browser, potentially leading to unauthorized actions or data theft.

Technologies: [Forgejo](https://junglewise.ai/threats/technologies/forgejo). Vendors: [Forgejo](https://junglewise.ai/threats/vendors/forgejo).

## Quick answers

**Is CVE-2026-59102 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-59102 being exploited in the wild.

**How severe is CVE-2026-59102?** Medium severity, with a CVSS score of 5.4, published 2 July 2026.

**Which products and versions are affected?** Forgejo < 15.0.3.

**Is there a fix for CVE-2026-59102?** A patch was published on 2026-06-10: Security patches merged into v15.0 branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-59102 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-59102?** Check whether you run Forgejo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stored cross-site scripting (XSS) vulnerability exists in Forgejo's Actions run view. When the 'DEFAULT_SHOW_FULL_NAME' option is enabled in app.ini, the 'GetDisplayName()' function returns the user's raw FullName without sanitization. This value is interpolated into an HTML-bearing locale format string (e.g., 'on_push_description') server-side. The resulting string is then rendered in the Vue.js frontend using a 'v-html' binding, which executes any embedded JavaScript. An authenticated attacker can exploit this by setting their full name to a malicious payload and triggering an Actions run (e.g., via a git push). The script executes when any user views the affected Actions run page. This issue is fixed in version 15.0.3 by applying HTML escaping to the display name before interpolation.

## Affected products

- Forgejo Forgejo < 15.0.3

## Timeline

- 2026-05-22: disclosed: Vulnerability reported to maintainers via email
- 2026-06-10: patched: Security patches merged into v15.0 branch
- 2026-07-02: advisory: CVE-2026-59102 published

## References

- [https://codeberg.org/forgejo/forgejo/pulls/13002](https://codeberg.org/forgejo/forgejo/pulls/13002)
- [https://codeberg.org/forgejo/forgejo/src/branch/forgejo/release-notes-published/15.0.3.md](https://codeberg.org/forgejo/forgejo/src/branch/forgejo/release-notes-published/15.0.3.md)
- [https://github.com/geo-chen/oss/blob/main/forgejo.md](https://github.com/geo-chen/oss/blob/main/forgejo.md)
- [https://www.vulncheck.com/advisories/forgejo-stored-xss-via-actions-run-full-name-rendering](https://www.vulncheck.com/advisories/forgejo-stored-xss-via-actions-run-full-name-rendering)

## Related threats

- [Forgejo GetPublicKey API information disclosure](https://junglewise.ai/threats/cve-2026-119547-forgejo-through-15-0-11-16-0-0-through-16-0-7-and-17-0-0-through)
- [Forgejo path traversal in restore-repo](https://junglewise.ai/threats/cve-2026-119546-forgejo-through-15-0-11-16-0-0-through-16-0-7-and-17-0-0-through)
- [Forgejo server-side request forgery in OpenID discovery](https://junglewise.ai/threats/cve-2026-119545-forgejo-through-15-0-11-16-0-0-through-16-0-7-and-17-0-0-through)
- [Forgejo ActivityPub identity spoofing via unbound HTTP signature](https://junglewise.ai/threats/cve-2026-90679-forgejo-activitypub-identity-spoofing-via-unbound-http-signature)
- [Forgejo authorization bypass in API pull request editing](https://junglewise.ai/threats/cve-2026-89151-forgejo-authorization-bypass-in-api-pull-request-editing)