CVE-2025-68942

Summary

Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

Severity

medium

EPSS

0.2% (p13)

Also known as

GHSA-898p-hh3p-hf9r, BIT-gitea-2025-68942, GO-2025-4263

Published

2025-12-30

References

• https://github.com/advisories/GHSA-898p-hh3p-hf9r
• https://nvd.nist.gov/vuln/detail/CVE-2025-68942
• https://blog.gitea.com/release-of-1.22.2

Related advisories

• CVE-2026-28737 — high · Go/code.gitea.io/gitea
• CVE-2026-24791 — high · Go/code.gitea.io/gitea
• CVE-2026-22555 — high · Go/code.gitea.io/gitea
• CVE-2026-26231 — high · Go/code.gitea.io/gitea
• CVE-2026-28699 — high · Go/code.gitea.io/gitea
• CVE-2026-28744 — high · Go/code.gitea.io/gitea
• CVE-2026-20706 — medium · Go/code.gitea.io/gitea
• CVE-2026-27783 — medium · Go/code.gitea.io/gitea

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity