A stored cross-site scripting vulnerability in Gogs, affecting versions prior to 0.14.2, allows authenticated attackers to execute arbitrary code within the context of other users' sessions.

The application fails to properly sanitize user input in the comment and issue description functions, specifically by permitting data URI schemes. This allows an authenticated attacker to inject malicious JavaScript, which executes when a victim views the crafted content.

Successful exploitation allows an attacker to perform actions on behalf of other users, including administrators, potentially leading to unauthorized data access or session hijacking. With a CVSS score of 8.7, this vulnerability poses a high risk to the confidentiality and integrity of the Git repository environment. The potential for administrative account compromise significantly elevates the threat to the entire software development lifecycle managed by the platform.

Immediate Action: Update Gogs to version 0.14.2 or later to resolve the underlying sanitization flaw.

Proactive Monitoring: Review access logs for unusual activity or suspicious links within comments and issue descriptions that deviate from standard development workflows.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to inspect and block malicious data URI schemes or injected script tags in web traffic.

Public Exploit Available: No (exploit_available: false)

Given the high CVSS score and the potential for lateral movement through administrative account compromise, immediate patching is essential. Organizations using Gogs should prioritize updating to version 0.14.2 to eliminate this XSS vector and secure their development collaboration environment.