CVE-2026-52816 Gogs: Unauthenticated Jupyter Notebook (ipynb) Sanitizer allows arbitrary data: URIs leading to XSS
An unauthenticated user can inject malicious JavaScript via data URIs in Jupyter Notebook sanitization, leading to Cross-Site Scripting.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-52816?
CVE-2026-52816 is a medium-severity cross-site scripting vulnerability in gogs, published on 24 Jun 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Gogs is an open source self-hosted Git service. Prior to 0.14.3, the Jupyter Notebook (ipynb) sanitizer endpoint at POST /-/api/sanitize_ipynb allows arbitrary data: URIs without proper restrictions, potentially leading to Cross-Site Scripting (XSS). The endpoint uses bluemonday.UGCPolicy() with p.AllowURLSchemes("data") which permits all data URI schemes including data:text/html, enabling attackers to inject malicious HTML/JavaScript. Additionally, the endpoint has no authentication middleware, allowing any registered user to exploit this vulnerability. This vulnerability is fixed in 0.14.3.
Weakness: CWE-80
Which versions are affected by CVE-2026-52816?
3 open source packages ship an affected version, including gogs.io/gogs.
| Package | Affected | Fixed in |
|---|---|---|
gogs.io/gogs Go | All versions | None |
gogs.io/gogs Go | All versions | 0.14.3 |
gogs.io/gogs Go | All versions | 0.14.3 |
How do I fix CVE-2026-52816?
Upgrade gogs.io/gogs to 0.14.3 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-52816 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-52816 exists.
Sources
Also known as GHSA-3w28-36p9-w929, GO-2026-5103.