https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T22:23:07.334845+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2026-10838 bdu:2026-10838 2026-10-03T22:23:07.337961+00:00 bdu:2026-10838 https://cve.radiocsirt.org/vuln/euvd-2026-333738 EUVD-2026-333738 2026-10-03T22:23:07.337993+00:00 EUVD-2026-333738 https://cve.radiocsirt.org/vuln/fkie_cve-2026-28737 fkie_cve-2026-28737 2026-10-03T22:23:07.338007+00:00

Gitea versions from 1.25.0 before 1.26.0 allow stored cross-site scripting through the extensionsRequired field in glTF files rendered by the 3D file viewer.

 https://cve.radiocsirt.org/vuln/ghsa-9cpj-qc93-vw8v GHSA-9cpj-qc93-vw8v — Gitea: Stored XSS via glTF `extensionsRequired` in Gitea 3D File Viewer 2026-10-03T22:23:07.338034+00:00

Affected: Go: code.gitea.io/gitea

## Summary

Me again.

Gitea's built-in 3D file viewer (powered by Online3DViewer) is vulnerable to stored cross-site scripting (XSS) through crafted `.gltf` files. When a glTF file declares an unsupported required extension, Online3DViewer generates an error message containing the extension name and Gitea inserts it into the DOM using `innerHTML` without sanitization. An attacker who can push a `.gltf` file to any repository can execute arbitrary JavaScript in the context of any user who views the file.

## Affected Versions

- Gitea **1.25.0** and later (3D file preview was introduced in 1.25 via the Online3DViewer integration) - Confirmed on `gitea:1.25-nightly` (SHA `e33d1da...`), which bundles `online-3d-viewer` npm package v0.16.0 - The upstream [Online3DViewer](https://github.com/kovacsv/Online3DViewer) library is the root cause

## Severity

- Stored XSS: the payload persists in the repository and fires on every page view - Executes under the Gitea origin with the victim's session (cookies, CSRF tokens) - Any authenticated user viewing the file is compromised - Enables full account takeover (token creation, settings modification, repository manipulation) - No user interaction beyond viewing the file page is required

## Details

### Root Cause

When Online3DViewer parses a glTF file, it checks whether all `extensionsRequired` entries are supported. For unsupported extensions, it calls:

```javascript // In the Online3DViewer bundle (online-3d-viewer.js) // Approximat…

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1172 WID-SEC-W-2026-1172 — Gitea: Mehrere Schwachstellen 2026-10-03T22:23:07.338087+00:00

Ein Angreifer kann mehrere Schwachstellen in Gitea ausnutzen, um Informationen offenzulegen, um Sicherheitsvorkehrungen zu umgehen, und um einen Cross-Site Scripting Angriff durchzuführen.