Go/gogs.io/gogs CVE-2026-52816: medium 5.4, EPSS 0.68%

Gogs's Unauthenticated Jupyter Notebook (ipynb) Sanitizer allows arbitrary data: URIs leading to XSS

Action: Upgrade gogs.io/gogs to 0.14.3 or later.

go get gogs.io/gogs@v0.14.3

Affected

Fixed versions

Sources

• osv: GHSA-3w28-36p9-w929
• nvd: CVE-2026-52816
• https://github.com/gogs/gogs/security/advisories/GHSA-3w28-36p9-w929
• https://github.com/gogs/gogs/pull/8326
• https://github.com/gogs/gogs/commit/dd1bd9837aa196b3ed3a8ee21e5727b5d7a986a3
• https://github.com/gogs/gogs
• https://github.com/gogs/gogs/releases/tag/v0.14.3

CVE-2026-52816 · published 2026-06-23T17:33:32Z · modified 2026-07-21T13:30:31.797159202Z · JSON