Executive brief
Gogs, a self-hosted Git service, is vulnerable to a security flaw where malicious Jupyter notebook files can execute unauthorized code in a user's browser. An attacker with repository access can upload a specially crafted file that, when viewed by another user or administrator, could lead to account takeover. This occurs because the software uses an outdated component to display these notebook files.
Technical details
Gogs utilizes an outdated version of the notebookjs library (v0.4.2) to render Jupyter notebook (.ipynb) files. This version lacks patches for several known Cross-Site Scripting (XSS) vulnerabilities, specifically allowing the execution of arbitrary JavaScript through malicious HTML tags embedded in Markdown cells. An attacker with low privileges (the ability to create or contribute to a repository) can upload a crafted .ipynb file. When a victim views this file, the payload executes in the context of the victim's session, potentially allowing for session hijacking or account takeover. The issue is resolved in Gogs version 0.14.3 by updating the underlying dependency.
Affected products
- Gogs Gogs < 0.14.3
Timeline
- 2026-06-19: disclosed
- 2026-06-19: advisory
- 2026-06-19: patched: Fixed in version 0.14.3
References
- https://api.github.com/users/Aikido-Security
- https://github.com/Aikido-Security
- https://api.github.com/users/Aikido-Security/gists%7B/gist_id%7D
- https://api.github.com/users/Aikido-Security/repos
- https://avatars.githubusercontent.com/u/240550485?v=4
- https://api.github.com/users/Aikido-Security/events%7B/privacy%7D