https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 22:22:49 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-10838 bdu:2026-10838 https://cve.radiocsirt.org/vuln/bdu:2026-10838 https://cve.radiocsirt.org/vuln/euvd-2026-333738 EUVD-2026-333738 https://cve.radiocsirt.org/vuln/euvd-2026-333738 https://cve.radiocsirt.org/vuln/fkie_cve-2026-28737 <p>Gitea versions from 1.25.0 before 1.26.0 allow stored cross-site scripting through the extensionsRequired field in glTF files rendered by the 3D file viewer.</p> <p>Gitea versions from 1.25.0 before 1.26.0 allow stored cross-site scripting through the extensionsRequired field in glTF files rendered by the 3D file viewer.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-28737 https://cve.radiocsirt.org/vuln/ghsa-9cpj-qc93-vw8v <p><strong>Affected:</strong> Go: code.gitea.io/gitea</p> <p>## Summary</p> <p>Me again.</p> <p>Gitea&#39;s built-in 3D file viewer (powered by Online3DViewer) is vulnerable to stored cross-site scripting (XSS) through crafted `.gltf` files. When a glTF file declares an unsupported required extension, Online3DViewer generates an error message containing the extension name and Gitea inserts it into the DOM using `innerHTML` without sanitization. An attacker who can push a `.gltf` file to any repository can execute arbitrary JavaScript in the context of any user who views the file.</p> <p>## Affected Versions</p> <p>- Gitea **1.25.0** and later (3D file preview was introduced in 1.25 via the Online3DViewer integration) - Confirmed on `gitea:1.25-nightly` (SHA `e33d1da...`), which bundles `online-3d-viewer` npm package v0.16.0 - The upstream [Online3DViewer](https://github.com/kovacsv/Online3DViewer) library is the root cause</p> <p>## Severity</p> <p>- Stored XSS: the payload persists in the repository and fires on every page view - Executes under the Gitea origin with the victim&#39;s session (cookies, CSRF tokens) - Any authenticated user viewing the file is compromised - Enables full account takeover (token creation, settings modification, repository manipulation) - No user interaction beyond viewing the file page is required</p> <p>## Details</p> <p>### Root Cause</p> <p>When Online3DViewer parses a glTF file, it checks whether all `extensionsRequired` entries are supported. For unsupported extensions, it calls:</p> <p>```javascript // In the Online3DViewer bundle (online-3d-viewer.js) // Approximat…</p> <p><strong>Affected:</strong> Go: code.gitea.io/gitea</p> <p>## Summary</p> <p>Me again.</p> <p>Gitea&#39;s built-in 3D file viewer (powered by Online3DViewer) is vulnerable to stored cross-site scripting (XSS) through crafted `.gltf` files. When a glTF file declares an unsupported required extension, Online3DViewer generates an error message containing the extension name and Gitea inserts it into the DOM using `innerHTML` without sanitization. An attacker who can push a `.gltf` file to any repository can execute arbitrary JavaScript in the context of any user who views the file.</p> <p>## Affected Versions</p> <p>- Gitea **1.25.0** and later (3D file preview was introduced in 1.25 via the Online3DViewer integration) - Confirmed on `gitea:1.25-nightly` (SHA `e33d1da...`), which bundles `online-3d-viewer` npm package v0.16.0 - The upstream [Online3DViewer](https://github.com/kovacsv/Online3DViewer) library is the root cause</p> <p>## Severity</p> <p>- Stored XSS: the payload persists in the repository and fires on every page view - Executes under the Gitea origin with the victim&#39;s session (cookies, CSRF tokens) - Any authenticated user viewing the file is compromised - Enables full account takeover (token creation, settings modification, repository manipulation) - No user interaction beyond viewing the file page is required</p> <p>## Details</p> <p>### Root Cause</p> <p>When Online3DViewer parses a glTF file, it checks whether all `extensionsRequired` entries are supported. For unsupported extensions, it calls:</p> <p>```javascript // In the Online3DViewer bundle (online-3d-viewer.js) // Approximat…</p> https://cve.radiocsirt.org/vuln/ghsa-9cpj-qc93-vw8v https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1172 <p>Ein Angreifer kann mehrere Schwachstellen in Gitea ausnutzen, um Informationen offenzulegen, um Sicherheitsvorkehrungen zu umgehen, und um einen Cross-Site Scripting Angriff durchzuführen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Gitea ausnutzen, um Informationen offenzulegen, um Sicherheitsvorkehrungen zu umgehen, und um einen Cross-Site Scripting Angriff durchzuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1172