https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 06:29:52 +0000 https://cve.radiocsirt.org/vuln/cve-2026-52807 <p><strong>Affected:</strong> gogs</p> <p>Gogs is an open source self-hosted Git service. Prior to 0.14.3, in new_form.tmpl, milestone names are rendered with Go&#39;s default auto-escaping ({{.Name}}), which converts &lt; to &amp;lt; etc. This prevents direct HTML injection. However, when the browser renders the DOM, the text content of the element contains the decoded original payload. Semantic UI 2.4.2&#39;s dropdown component has preserveHTML: true as the default setting. When a user selects a dropdown item, the internal set.text() method calls jQuery&#39;s .html() with the item&#39;s text content. This re-parses the decoded text as HTML, creating the injected element and triggering the JavaScript event handler. An attacker can store an HTML/JavaScript payload in a milestone name, and when any user opens the New Issue page and interacts with the milestone dropdown, the payload executes in their browser via Semantic UI&#39;s preserveHTML behavior. This vulnerability is fixed in 0.14.3.</p> <p><strong>Affected:</strong> gogs</p> <p>Gogs is an open source self-hosted Git service. Prior to 0.14.3, in new_form.tmpl, milestone names are rendered with Go&#39;s default auto-escaping ({{.Name}}), which converts &lt; to &amp;lt; etc. This prevents direct HTML injection. However, when the browser renders the DOM, the text content of the element contains the decoded original payload. Semantic UI 2.4.2&#39;s dropdown component has preserveHTML: true as the default setting. When a user selects a dropdown item, the internal set.text() method calls jQuery&#39;s .html() with the item&#39;s text content. This re-parses the decoded text as HTML, creating the injected element and triggering the JavaScript event handler. An attacker can store an HTML/JavaScript payload in a milestone name, and when any user opens the New Issue page and interacts with the milestone dropdown, the payload executes in their browser via Semantic UI&#39;s preserveHTML behavior. This vulnerability is fixed in 0.14.3.</p> https://cve.radiocsirt.org/vuln/cve-2026-52807