CVE-2025-47943 Gogs stored XSS in PDF renderer
Stored XSS in Gogs allows client-side JavaScript execution via a vulnerable PDF renderer component, requiring an upgrade to fix.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-47943?
CVE-2025-47943 is a medium-severity cross-site scripting vulnerability in gogs, published on 24 Jun 2025. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Gogs is an open source self-hosted Git service. In application version 0.14.0+dev and prior, there is a stored cross-site scripting (XSS) vulnerability present in Gogs, which allows client-side Javascript code execution. The vulnerability is caused by the usage of a vulnerable and outdated component: pdfjs-1.4.20 under public/plugins/. This issue has been fixed for gogs.io/gogs in version 0.13.3.
Weakness: CWE-79
Which versions are affected by CVE-2025-47943?
5 open source packages ship an affected version, including gogs.io/gogs and github.com/gogs/gogs.
| Package | Affected | Fixed in |
|---|---|---|
gogs.io/gogs Go | All versions | 0.13.3-0.20250608224432-110117b2e5e5 |
gogs.io/gogs Go | All versions | 0.13.3-0.20250608224432-110117b2e5e5 |
gogs.io/gogs Go | All versions | 0.13.3-0.20250608224432-110117b2e5e5 |
github.com/gogs/gogs Go | All versions | 0.13.3-0.20250608224432-110117b2e5e5 |
github.com/gogs/gogs Go | All versions | 0.13.3-0.20250608224432-110117b2e5e5 |
How do I fix CVE-2025-47943?
Upgrade gogs.io/gogs to 0.13.3-0.20250608224432-110117b2e5e5 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2025-47943 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-47943 exists.
Sources
Also known as GHSA-xh32-cx6c-cp4v, GO-2025-3778.