{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.13.3"
      },
      "package": {
        "ecosystem": "Go",
        "name": "gogs.io/gogs"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.13.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-1395",
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-02-06T19:44:14Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\nStored XSS via mermaid diagrams due to usage of vulnerable renderer library\n\n### Details\nGogs introduced support for rendering mermaid diagrams in version [0.13.0.](https://github.com/gogs/gogs/releases/tag/v0.13.0)\n\nCurrently used version of the library [mermaid 11.9.0](https://github.com/gogs/gogs/tree/main/public/plugins/mermaid-11.9.0) is vulnerable to at least two XSS scenarios with publicly available payloads\n\nResources:\nhttps://github.com/mermaid-js/mermaid/security/advisories/GHSA-7rqq-prvp-x9jh\nhttps://github.com/mermaid-js/mermaid/security/advisories/GHSA-8gwm-58g9-j8pw\n\n### PoC\n\n1. Create a markdown file eg. `README.md` containing following malicious mermaid diagram (payload based on [CVE-2025-54880](https://github.com/mermaid-js/mermaid/security/advisories/GHSA-8gwm-58g9-j8pw))\n```\narchitecture-beta\n    group api(cloud)[API]\n    service db \"\u003cimg src=x onerror=\\\"alert(document.domain)\\\"\u003e\" [Database] in api\n```\n2. The XSS should pop whenever either repository or file is viewed\n\n#### Demo\n\nhttps://github.com/user-attachments/assets/98320f62-6c1c-4254-aa61-95598c725235\n\n### Impact\nThe attacker can potentially achieve account takeover\nIn a worst case scenario if the victim were an instance admin this could lead to a compromise of the entire deployment\n\n### Proposed remediation steps\n1. Upgrade to a patched version of the third party library\nhttps://github.com/mermaid-js/mermaid/releases/tag/v10.9.5\n2. Consider running mermaid using `sandbox` level which would mitigate impact of future potential cross-site scripting issues\nhttps://mermaid.js.org/config/usage.html#securitylevel",
  "id": "GHSA-26gq-grmh-6xm6",
  "modified": "2026-02-06T19:44:14Z",
  "published": "2026-02-06T19:44:14Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/gogs/gogs/security/advisories/GHSA-26gq-grmh-6xm6"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mermaid-js/mermaid/security/advisories/GHSA-7rqq-prvp-x9jh"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mermaid-js/mermaid/security/advisories/GHSA-8gwm-58g9-j8pw"
    },
    {
      "type": "WEB",
      "url": "https://github.com/gogs/gogs/commit/71a72a72ad1c8cea7940c9d7e4cbdfbc0fc3d401"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/gogs/gogs"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Gogs vulnerable to Stored XSS via Mermaid diagrams"
}