CVE-2026-52816

Name of the Vulnerable Software and Affected Versions Gogs versions prior to 0.14.3

Description The Jupyter Notebook (ipynb) sanitizer endpoint at 'POST /-/api/sanitize ipynb' allows arbitrary data: URIs without proper restrictions, which can lead to Cross-Site Scripting (XSS). The endpoint utilizes bluemonday.UGCPolicy() with p.AllowURLSchemes("data"), permitting all data URI schemes, including data:text/html, which enables the injection of malicious HTML or JavaScript. Furthermore, the endpoint lacks authentication middleware, allowing any registered user to exploit this issue.

Recommendations Update to version 0.14.3. As a temporary workaround, restrict access to the 'POST /-/api/sanitize ipynb' endpoint to minimize the risk of exploitation.