CVE-2024-6886: Gitea Cross-site Scripting Vulnerability
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gitea Gitea Open Source Git Server allows Stored XSS.This issue affects Gitea Open Source Git Server: 1.22.0.
Published Aug 6, 2024 · Updated Aug 7, 2024
Affected packages
code.gitea.io/gitea
- Ecosystem
- Go
- Affected
- < 1.22.1
- Fixed in
- 1.22.1
- Check
go list -m code.gitea.io/gitea
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gitea Gitea Open Source Git Server allows Stored XSS.This issue affects Gitea Open Source Git Server: 1.22.0.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology
More Go vulnerabilities
All Go entriesCVE-2026-20896
Gitea Docker image: `REVERSE_PROXY_TRUSTED_PROXIES = *` default lets any source IP impersonate any user via `X-WEBAUTH-USER`
critical9.8Jul 21, 2026CVE-2026-22874
Gitea: Incomplete SSRF Protection in Webhook and Migration Allow-list Default Filter
critical9.6Jul 21, 2026CVE-2026-56750
Gitea Remember-Me Token Theft Not Invalidating Attacker Session
critical9.1Jul 21, 2026CVE-2026-58426
Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write
critical9.6Jul 21, 2026CVE-2026-58443
Gitea: Public-only repository tokens can update private PR head branches
critical9.6Jul 21, 2026CVE-2026-22547
Gitea repository creation accepts insufficiently validated fields
critical9.1Jul 3, 2026