All intelligence
// vulnerability record
cached · NVD via COSMOS syncCVE-2026-59102
LOWpublished 2026-07-02 20:17 UTC · 2 days ago
2.1
CVSS / 10
// description
Forgejo before 15.0.3 contains a stored cross-site scripting vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by setting a full name containing an HTML payload and triggering an Actions run. When the DEFAULT_SHOW_FULL_NAME option is enabled, the run description is assembled server-side with the user's display name interpolated into an HTML string via a translation function that does not escape its arguments, and the frontend renders the result using a Vue v-html binding, causing script execution for any user who views the affected Actions run page.
// weaknesses (CWE)
- CWE-79