Read the docs
TI-2024-06386 Aliases CVE-2024-6886GHSA-4h4p-553m-46qh

Inproper Sanitation of field leading to stored XSS

Priority HIGH 74CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gitea Gitea Open Source Git Server allows Stored XSS.This issue affects Gitea Open Source Git Server: 1.22.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.32968 98th percentileScored 2026-11-07
Fix Fixed code.gitea.io/gitea (Go): 1.22.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
GiteaGitea Open Source Git Server1.22.0—No fix listedCNA
—code.gitea.io/gitea (Go)before 1.22.11.22.1Patch availableGHSA-4h4p-553m-46qh
  • Gitea Open Source Git Server VendorGitea Affected 1.22.0 Fixed in — No fix listed CNA
  • code.gitea.io/gitea (Go) Vendor— Affected before 1.22.1 Fixed in 1.22.1 Patch available GHSA-4h4p-553m-46qh

CPE names CISA-ADP · 1

CPEVersionsRoleVendor
cpe:2.3:a:gitea:gitea:1.22.0:*:*:*:*:*:*:*1.22.0—Gitea
  • cpe:2.3:a:gitea:gitea:1.22.0:*:*:*:*:*:*:* Versions 1.22.0 — ·Gitea

Remediation

  • Fix · GHSA-4h4p-553m-46qh code.gitea.io/gitea (Go) Fixed in 1.22.1 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Not affected: 4 products
  • OpenShift Pipelines
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift Data Science (RHODS)
  • Red Hat OpenShift GitOps

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-6886
  2. 2026-10-03 Alias added: GHSA-4h4p-553m-46qh

References

Advisory 1

Other 6

  • TI-2026-42785 Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation. KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-42033 Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts CVSS 3.1CRITICAL 9.8
  • TI-2026-40842 Privilege Escalation via Access Token Scope Escalation in API CVSS 3.1CRITICAL 9.8
  • TI-2026-16922 Gitea Docker image trusts spoofable reverse-proxy headers by default CVSS 3.1CRITICAL 9.8
  • TI-2026-42043 Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting CVSS 3.1CRITICAL 9.1
  • TI-2026-40381 OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes CVSS 3.1CRITICAL 9.1
See all 240 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences