CVE-2026-52816

The record

Gogs is an open source self-hosted Git service. Prior to 0.14.3, the Jupyter Notebook (ipynb) sanitizer endpoint at POST /-/api/sanitize_ipynb allows arbitrary data: URIs without proper restrictions, potentially leading to Cross-Site Scripting (XSS). The endpoint uses bluemonday.UGCPolicy() with p.AllowURLSchemes("data") which permits all data URI schemes including data:text/html, enabling attackers to inject malicious HTML/JavaScript. Additionally, the endpoint has no authentication middleware, allowing any registered user to exploit this vulnerability. This vulnerability is fixed in 0.14.3.

Affected packages

Related vulnerabilities

• CVE-2026-52773 YesWiki is a wiki system written in PHP. CWE-80
• CVE-2026-52774 YesWiki is a wiki system written in PHP. CWE-80
• CVE-2026-32773 There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which allows a… CWE-80
• CVE-2026-82838 The default docker image shipped for Venueless did not properly ensure that uploaded SVG… CWE-80
• CVE-2026-55696 PrivateBin is an online pastebin where the server has zero knowledge of pasted data. CWE-80
• CVE-2026-5218 Improper neutralization of Script-Related HTML tags in a web page (basic XSS)… CWE-80
• CVE-2026-20232 A vulnerability in the web-based management interface of Cisco Industrial Ethernet (IE)… CWE-80
• CVE-2026-52854 Maps is a MediaWiki extension that enables visualization of geographic data through… CWE-80