Gitea: Stored XSS via glTF `extensionsRequired` in Gitea 3D File Viewer
Date: 2026-06
Affected: go/code.gitea.io/gitea
Attack vector: xss
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2026-28737
CWE: CWE-79
CVSS: 8.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N)

## Summary Me again. Gitea's built-in 3D file viewer (powered by Online3DViewer) is vulnerable to stored cross-site scripting (XSS) through crafted `.gltf` files. When a glTF file declares an unsupported required extension, Online3DViewer generates an error message containing the extension name and Gitea inserts it into the DOM using `innerHTML` without sanitization. An attacker who can push a `.gltf` file to any repository can execute arbitrary JavaScript in the context of any user who views the file. ## Affected Versions - Gitea **1.25.0** and later (3D file preview was introduced in 1.25 via the Online3DViewer integration) - Confirmed on `gitea:1.25-nightly` (SHA `e33d1da...`), which bundles `online-3d-viewer` npm package v0.16.0 - The upstream [Online3DViewer](https://github.com/kovacsv/Online3DViewer) library is the root cause ## Severity - Stored XSS: the payload persists in the repository and fires on every page view - Executes under the Gitea origin with the victim's session (cookies, CSRF tokens) - Any authenticated user viewing the file is compromised - Enables full account takeover (token creation, settings modification, repository manipulation) - No user interaction beyond viewing the file page is required ## Details ### Root Cause When Online3DViewer parses a glTF file, it checks whether all `extensionsRequired` entries are supported. For unsupported extensions, it calls: ```javascript // In the Online3DViewer bundle (online-3d-viewer.js) // Approximate


Mitigations:

Architectural layers (MAESTRO):