Sign in Get started

← All advisories

Moderate severityOSV Advisory· Published Dec 26, 2025· Updated Dec 26, 2025

CVE-2025-68946

CVE-2025-68946

Description

In Gitea before 1.20.1, a forbidden URL scheme such as javascript: can be used for a link, aka XSS.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
code.gitea.io/giteaGo	< 1.20.1	1.20.1

Affected products

1

Go Gitea/GiteaOSV
Range: v0.9.99, v1.0.0, v1.1.0, …

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

6

github.com/advisories/GHSA-hq57-c72x-4774ghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2025-68946ghsaADVISORY
blog.gitea.com/release-of-1.20.1ghsaWEB
github.com/go-gitea/gitea/pull/25960ghsaWEB
github.com/go-gitea/gitea/releases/tag/v1.20.1ghsaWEB
blog.gitea.com/release-of-1.20.1/mitre

News mentions

0

No linked articles in our index yet.