CVE-2026-52796

The record

Gogs is an open source self-hosted Git service. Prior to 0.14.3, specially crafted issue index pattern can cause a panic when rendering, resulting in denial of service. In internal/markup/markup.go, RenderIssueIndexPattern renders the issue index pattern to a link using com.Expand, which is not safe: when the configured pattern contains an opening brace { but no closing brace }, strings.Index(template, "}") returns -1 and the subsequent slice template[:-1] triggers a panic. Once such a pattern is set, any page in the affected repository that contains an issue index reference such as #1 becomes unavailable. This vulnerability is fixed in 0.14.3.

Affected packages

Related vulnerabilities

• CVE-2026-96392 Improper Neutralization of Special Elements Used in a Template Engine vulnerability in… CWE-1336
• CVE-2026-96355 Improper Neutralization of Special Elements Used in a Template Engine vulnerability in… CWE-1336
• CVE-2026-104851 fsspec is a specification and Python implementation framework for filesystem interfaces. CWE-1336
• CVE-2026-9160 Improper neutralization of special elements used in a template engine vulnerability in… CWE-1336
• CVE-2026-19584 Velociraptor allows for the creation of notebook backups in its default enabled daily… CWE-1336
• CVE-2026-75650 Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a… CWE-1336
• CVE-2026-52762 YesWiki is a wiki system written in PHP. CWE-1336
• CVE-2026-85654 Improper neutralization of special elements used in a template engine in the CDK… CWE-1336