Volerion logoVolerion
Volerion logoVolerion

Gogs Stored Cross-Site Scripting Vulnerability in PDF Renderer

Vulnerability

A stored cross-site scripting vulnerability has been identified in Gogs, an open-source self-hosted Git service, in application versions through 0.14.0+dev. This vulnerability allows for the execution of client-side JavaScript. The issue arises from the use of an outdated component, pdfjs-1.4.20, located in public/plugins/.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where uploaded JavaScript is executed in the context of the user.

Reproduction

To reproduce this vulnerability, upload a PDF file containing JavaScript into a repository. Then, click on the uploaded file to preview it. The JavaScript will execute in the user's browser.

Remediation

Users can upgrade to Gogs version 0.13.3, where this vulnerability has been fixed.

Added: Jun 24, 2025, 4:56 AM
Updated: Jun 24, 2025, 4:56 AM

Vulnerability Rating

Custom Algorithm
spread
3.1
impact
1.7
exploitability
6.3
remediation
7.7
relevance
0.2
threat
6.4
urgency
2.9
incentive
1.7

Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.