{"api_version":"1","generated_at":"2026-11-15T23:38:08+00:00","cve":"CVE-2026-120729","urls":{"html":"https://cve.report/CVE-2026-120729","api":"https://cve.report/api/cve/CVE-2026-120729.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-120729","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-120729"},"summary":{"title":"Gitea stored cross-site scripting in the issue reference popup","description":"The popup shown when hovering an issue reference loaded its data from the path of the hovered link and inserted part of the response as HTML. A user who can post a comment or other rendered content could add a link that is displayed as an ordinary issue reference but points to a file in a repository they control, so that the popup inserted that file's content into the page of anyone hovering the link and ran script in the viewer's session. The popup now requests the issue by the owner, repository and index parsed from the link.","state":"PUBLISHED","assigner":"Gitea","published_at":"2026-11-15 22:17:17","updated_at":"2026-11-15 22:17:17"},"problem_types":["CWE-79","CWE-79 CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"],"metrics":[],"references":[{"url":"https://github.com/go-gitea/gitea/pull/40207","name":"https://github.com/go-gitea/gitea/pull/40207","refsource":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.4.0","name":"https://github.com/go-gitea/gitea/releases/tag/v28.4.0","refsource":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/go-gitea/gitea/pull/40225","name":"https://github.com/go-gitea/gitea/pull/40225","refsource":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-wmr3-xg9x-vc55","name":"https://github.com/go-gitea/gitea/security/advisories/GHSA-wmr3-xg9x-vc55","refsource":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://blog.gitea.com/release-of-28.4.0/","name":"https://blog.gitea.com/release-of-28.4.0/","refsource":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-120729","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120729","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Gitea","product":"Gitea","version":"affected 1.27.0 28.4.0 semver","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"https://github.com/silverwind","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","packageName":"gitea.dev","product":"Gitea","vendor":"Gitea","versions":[{"lessThan":"28.4.0","status":"affected","version":"1.27.0","versionType":"semver"}]}],"credits":[{"lang":"en","type":"remediation developer","value":"https://github.com/silverwind"}],"descriptions":[{"lang":"en","value":"The popup shown when hovering an issue reference loaded its data from the path of the hovered link and inserted part of the response as HTML. A user who can post a comment or other rendered content could add a link that is displayed as an ordinary issue reference but points to a file in a repository they control, so that the popup inserted that file's content into the page of anyone hovering the link and ran script in the viewer's session. The popup now requests the issue by the owner, repository and index parsed from the link."}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","description":"CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-15T21:13:53.375Z","orgId":"88ee5874-cf24-4952-aea0-31affedb7ff2","shortName":"Gitea"},"references":[{"name":"GitHub Security Advisory GHSA-wmr3-xg9x-vc55","tags":["vendor-advisory"],"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-wmr3-xg9x-vc55"},{"name":"Fix: go-gitea/gitea pull request #40207","tags":["patch"],"url":"https://github.com/go-gitea/gitea/pull/40207"},{"name":"Fix backport to release/v28: go-gitea/gitea pull request #40225","tags":["patch"],"url":"https://github.com/go-gitea/gitea/pull/40225"},{"name":"Gitea 28.4.0 release announcement","tags":["release-notes"],"url":"https://blog.gitea.com/release-of-28.4.0/"},{"name":"go-gitea/gitea v28.4.0 release","tags":["release-notes"],"url":"https://github.com/go-gitea/gitea/releases/tag/v28.4.0"}],"title":"Gitea stored cross-site scripting in the issue reference popup"}},"cveMetadata":{"assignerOrgId":"88ee5874-cf24-4952-aea0-31affedb7ff2","assignerShortName":"Gitea","cveId":"CVE-2026-120729","datePublished":"2026-11-15T21:13:53.375Z","dateReserved":"2026-11-15T20:29:37.625Z","dateUpdated":"2026-11-15T21:13:53.375Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-11-15 22:17:17","lastModifiedDate":"2026-11-15 22:17:17","problem_types":["CWE-79","CWE-79 CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"120729","Ordinal":"1","Title":"Gitea stored cross-site scripting in the issue reference popup","CVE":"CVE-2026-120729","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"120729","Ordinal":"1","NoteData":"The popup shown when hovering an issue reference loaded its data from the path of the hovered link and inserted part of the response as HTML. A user who can post a comment or other rendered content could add a link that is displayed as an ordinary issue reference but points to a file in a repository they control, so that the popup inserted that file's content into the page of anyone hovering the link and ran script in the viewer's session. The popup now requests the issue by the owner, repository and index parsed from the link.","Type":"Description","Title":"Gitea stored cross-site scripting in the issue reference popup"}]}}}