CVE-2022-31038 - CVE House
Back to Database
Status published Medium CVE-2022-31038

XSS vulnerability in repository issue list in Gogs

Vulnerability Description

Gogs is an open source self-hosted Git service. In versions of gogs prior to 0.12.9 `DisplayName` does not filter characters input from users, which leads to an XSS vulnerability when directly displayed in the issue list. This issue has been resolved in commit 155cae1d which sanitizes `DisplayName` prior to display to the user. All users of gogs are advised to upgrade. Users unable to upgrade should check their users' display names for malicious characters.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-31038

Credits & Attribution

No credits recorded in the NVD database.

References

More from gogs

View All →
CVE-2025-64719
Gogs: Denial of Service in repository/wiki file listing web pages
Medium 4.9
CVE-2025-64175
Gogs Vulnerable to 2FA Bypass via Recovery Code
High 7.7
CVE-2025-64111
Gogs's update .git/config file allows remote command execution
Critical 9.3
CVE-2025-47943
Gogs stored XSS in PDF renderer
Medium 6.3
CVE-2024-56731
Gogs deletion of internal files allows remote command execution
Critical 10

Affected Vendor

Affected Software

gogs
Vulnerable Versions:
< 0.12.9

Timeline

Official Publish: June 8th, 2022
Last Modified: April 23rd, 2025
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weaknesses (CWE)

CWE-79

MITRE ATT&CK TTPs

T1189 Drive-by Compromise
Initial Access
T1059.007 JavaScript
Execution
T1539 Steal Web Session Cookie
Collection
T1213 Data from Information Repositories
Collection
T1567 Exfiltration Over Web Service
Exfiltration
T1491.001 Defacement
Impact