Gogs's Unauthenticated Jupyter Notebook (ipynb) Sanitizer allows arbitrary data: URIs leading to XSS
Date: 2026-06
Affected: go/gogs.io/gogs
Attack vector: xss
Category: vulnerability-disclosure
Severity: Critical
CVE: CVE-2026-52798
CVE-2026-52806
CVE-2026-52807
CVE-2026-52809
CVE-2026-52811
CVE-2026-52812
CVE-2026-52816
CWE: CWE-22
CWE-324
CWE-345
CWE-59
CWE-61
CWE-613
CWE-639
CWE-77
CWE-79
CWE-80
CWE-862
CVSS:  (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N)

## Summary The Jupyter Notebook (ipynb) sanitizer endpoint at `POST /-/api/sanitize_ipynb` allows arbitrary `data:` URIs without proper restrictions, potentially leading to Cross-Site Scripting (XSS). The endpoint uses `bluemonday.UGCPolicy()` with `p.AllowURLSchemes("data")` which permits all data URI schemes including `data:text/html`, enabling attackers to inject malicious HTML/JavaScript. Additionally, the endpoint has no authentication middleware, allowing any registered user to exploit this vulnerability. ## Severity **High** ## Affected Versions All versions using the vulnerable endpoint ## Vulnerability Details - **CVE ID**: (To be assigned) - **Entry Point**: `POST /-/api/sanitize_ipynb` - **Attack Vector**: Network - **Authentication Required**: No (only needs a registered user account) ## Impact An attacker with a registered user account can: - Send malicious HTML containing `data:text/html` URIs to the sanitization endpoint - Receive sanitized but attacker-controlled HTML in the response - Execute arbitrary JavaScript in the attacker's browser context through XSS - Potentially exploit other users if the sanitized output is rendered in their context The vulnerability has higher severity because: 1. No authentication required (only needs a registered user account) 2. Unlike the safer pattern in `internal/markup/sanitizer.go:39` which uses `isSafeDataURI` to only allow safe image MIME types, this endpoint allows ALL data URIs including HTML 3. The returne


Mitigations:

Architectural layers (MAESTRO):