CVE-2022-32174

Gogs - XSS

In Gogs, versions v0.6.5 through v0.12.10 are vulnerable to Stored Cross-Site Scripting (XSS) that leads to an account takeover.

Affected

gogs

CVSS v3.1 NVD

9.0 CRITICALCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

EPSS

58.02% chance of exploitation in the next 30 days, 99th percentile

Published

2022-10-11

Updated

2025-05-16

Proof-of-concept exploits (1)

• https://www.mend.io/vulnerability-database/CVE-2022-32174

Security advisories

• gogs/gogs/blob/v0.12.10/public/js/gogs.js#L263
• advisories/GHSA-mcjj-2fvq-mc3r

References

• CVE Record
• NVD entry