XSS in Gogs

CVE-2026-52816

Gogs is an open source self-hosted Git service. Prior to 0.14.3, the Jupyter Notebook (ipynb) sanitizer endpoint at POST /-/api/sanitize_ipynb allows arbitrary data: URIs without proper restrictions, potentially leading to Cross-Site Scrip…

EPSS: 0.005 (38.5th percentile) — read the EPSS interpretation.

Affected products

  • Gogs — versions < 0.14.3

Weakness classification (CWE)

References