Skip to content
CVE PROGRAM SOURCE RECORD5.4 Medium

CVE-2025-68946

In Gitea before 1.20.1, a forbidden URL scheme such as javascript: can be used for a link, aka XSS.

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
mitre

Description

In Gitea before 1.20.1, a forbidden URL scheme such as javascript: can be used for a link, aka XSS.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Gitea Gitea

Default version status: unaffected

  • 1.20.0 to < 1.20.1affected
pkg:golang/code.gitea.io/gitea

References