{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-120729", "assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2", "state": "PUBLISHED", "assignerShortName": "Gitea", "dateReserved": "2026-11-15T20:29:37.625Z", "datePublished": "2026-11-15T21:13:53.375Z", "dateUpdated": "2026-11-15T21:13:53.375Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2", "shortName": "Gitea", "dateUpdated": "2026-11-15T21:13:53.375Z"}, "title": "Gitea stored cross-site scripting in the issue reference popup", "descriptions": [{"lang": "en", "value": "The popup shown when hovering an issue reference loaded its data from the path of the hovered link and inserted part of the response as HTML. A user who can post a comment or other rendered content could add a link that is displayed as an ordinary issue reference but points to a file in a repository they control, so that the popup inserted that file's content into the page of anyone hovering the link and ran script in the viewer's session. The popup now requests the issue by the owner, repository and index parsed from the link."}], "affected": [{"vendor": "Gitea", "product": "Gitea", "packageName": "gitea.dev", "defaultStatus": "unaffected", "versions": [{"version": "1.27.0", "status": "affected", "lessThan": "28.4.0", "versionType": "semver"}]}], "references": [{"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-wmr3-xg9x-vc55", "name": "GitHub Security Advisory GHSA-wmr3-xg9x-vc55", "tags": ["vendor-advisory"]}, {"url": "https://github.com/go-gitea/gitea/pull/40207", "name": "Fix: go-gitea/gitea pull request #40207", "tags": ["patch"]}, {"url": "https://github.com/go-gitea/gitea/pull/40225", "name": "Fix backport to release/v28: go-gitea/gitea pull request #40225", "tags": ["patch"]}, {"url": "https://blog.gitea.com/release-of-28.4.0/", "name": "Gitea 28.4.0 release announcement", "tags": ["release-notes"]}, {"url": "https://github.com/go-gitea/gitea/releases/tag/v28.4.0", "name": "go-gitea/gitea v28.4.0 release", "tags": ["release-notes"]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "credits": [{"lang": "en", "value": "https://github.com/silverwind", "type": "remediation developer"}]}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageName": "gitea.dev", "product": "Gitea", "vendor": "Gitea", "versions": [{"lessThan": "28.4.0", "status": "affected", "version": "1.27.0", "versionType": "semver"}]}], "source": "88ee5874-cf24-4952-aea0-31affedb7ff2"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The popup shown when hovering an issue reference loaded its data from the path of the hovered link and inserted part of the response as HTML. A user who can post a comment or other rendered content could add a link that is displayed as an ordinary issue reference but points to a file in a repository they control, so that the popup inserted that file's content into the page of anyone hovering the link and ran script in the viewer's session. The popup now requests the issue by the owner, repository and index parsed from the link."}], "id": "CVE-2026-120729", "lastModified": "2026-11-15T22:17:17.870", "metrics": {}, "published": "2026-11-15T22:17:17.773", "references": [{"source": "88ee5874-cf24-4952-aea0-31affedb7ff2", "url": "https://blog.gitea.com/release-of-28.4.0/"}, {"source": "88ee5874-cf24-4952-aea0-31affedb7ff2", "url": "https://github.com/go-gitea/gitea/pull/40207"}, {"source": "88ee5874-cf24-4952-aea0-31affedb7ff2", "url": "https://github.com/go-gitea/gitea/pull/40225"}, {"source": "88ee5874-cf24-4952-aea0-31affedb7ff2", "url": "https://github.com/go-gitea/gitea/releases/tag/v28.4.0"}, {"source": "88ee5874-cf24-4952-aea0-31affedb7ff2", "url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-wmr3-xg9x-vc55"}], "sourceIdentifier": "88ee5874-cf24-4952-aea0-31affedb7ff2", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "88ee5874-cf24-4952-aea0-31affedb7ff2", "type": "Secondary"}]}

{}

{"created": "2026-11-15T22:30:05.522725+00:00", "updated": "2026-11-15T22:30:05.522729+00:00", "vendors": []}