{"id":"GO-2026-5286","revision":null,"records":[{"revision":"2fc1db9f69464a5f94f0519d3fa260b9","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-28737","aliases":[],"title":"Gitea 3D file viewer allows stored XSS through glTF extensionsRequired","description":"Gitea versions from 1.25.0 before 1.26.0 allow stored cross-site scripting through the extensionsRequired field in glTF files rendered by the 3D file viewer.","state":0,"publishedAt":"2026-07-03T20:19:39.358+00:00","modifiedAt":"2026-07-07T16:58:33.235+00:00","affected":[{"ecosystem":"Vendor product","name":"Gitea Open Source Git Server","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Gitea\",\n                    \"product\": \"Gitea Open Source Git Server\",\n                    \"versions\": [\n                        {\n                            \"version\": \"1.25.0\",\n                            \"lessThan\": \"1.26.0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","score":8.7,"severity":"HIGH"}],"references":["https://github.com/go-gitea/gitea/security/advisories/GHSA-9cpj-qc93-vw8v","https://github.com/go-gitea/gitea/pull/37233","https://github.com/go-gitea/gitea/releases/tag/v1.26.0","https://blog.gitea.com/release-of-1.26.0/"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-28737","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-28737","identifiers":["CVE-2026-28737"]},"retained":false,"historicalAffected":[]},{"revision":"2fd7c7e0475a4774bd65f3728dde8ab2","observedAt":"2026-11-07T06:34:12.302+00:00","statement":{"source":"euvd","id":"EUVD-2026-41642","aliases":["CVE-2026-28737","GHSA-9cpj-qc93-vw8v"],"title":"Gitea versions from 1.25.0 before 1.26.0 allow stored cross-site scripting through the extensionsRequired field in glTF files rendered by the 3D file viewer.","description":"Gitea versions from 1.25.0 before 1.26.0 allow stored cross-site scripting through the extensionsRequired field in glTF files rendered by the 3D file viewer.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","score":8.7,"severity":null}],"references":["https://github.com/go-gitea/gitea/security/advisories/GHSA-9cpj-qc93-vw8v","https://github.com/go-gitea/gitea/pull/37233","https://github.com/go-gitea/gitea/releases/tag/v1.26.0","https://blog.gitea.com/release-of-1.26.0/"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-41642","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Jul 3, 2026, 8:19:39 PM","dateUpdated":"Jul 7, 2026, 4:58:33 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-41642","identifiers":["EUVD-2026-41642","CVE-2026-28737","GHSA-9cpj-qc93-vw8v"]},"retained":false,"historicalAffected":[]},{"revision":"c17792914d9e48879a2424a6bd80b726","observedAt":"2026-10-27T07:23:38.985+00:00","statement":{"source":"nvd","id":"CVE-2026-28737","aliases":[],"title":"Gitea versions from 1.25.0 before 1.26.0 allow stored cross-site scripting through the extensionsRequired field in glTF files rendered by the 3D file viewer.","description":"Gitea versions from 1.25.0 before 1.26.0 allow stored cross-site scripting through the extensionsRequired field in glTF files rendered by the 3D file viewer.","state":0,"publishedAt":"2026-07-03T21:16:59.787+00:00","modifiedAt":"2026-10-25T15:10:00.147+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · 88ee5874-cf24-4952-aea0-31affedb7ff2 · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","score":8.7,"severity":"HIGH"}],"references":["https://blog.gitea.com/release-of-1.26.0/","https://github.com/go-gitea/gitea/pull/37233","https://github.com/go-gitea/gitea/releases/tag/v1.26.0","https://github.com/go-gitea/gitea/security/advisories/GHSA-9cpj-qc93-vw8v"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-28737","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-79"],"productCriteria":[],"sourceDates":{"published":"2026-07-03T21:16:59.787","lastModified":"2026-10-25T15:10:00.147"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-28737","identifiers":["CVE-2026-28737"]},"retained":false,"historicalAffected":[]},{"revision":"8e74cf90cfbb4e7ab9916a7d40f45415","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-9cpj-qc93-vw8v","aliases":["CVE-2026-28737","GO-2026-5286"],"title":"Gitea: Stored XSS via glTF `extensionsRequired` in Gitea 3D File Viewer","description":"## Summary\n\nMe again.\n\nGitea's built-in 3D file viewer (powered by Online3DViewer) is vulnerable to stored cross-site scripting (XSS) through crafted `.gltf` files. When a glTF file declares an unsupported required extension, Online3DViewer generates an error message containing the extension name and Gitea inserts it into the DOM using `innerHTML` without sanitization. An attacker who can push a `.gltf` file to any repository can execute arbitrary JavaScript in the context of any user who views the file.\n\n## Affected Versions\n\n- Gitea **1.25.0** and later (3D file preview was introduced in 1.25 via the Online3DViewer integration)\n- Confirmed on `gitea:1.25-nightly` (SHA `e33d1da...`), which bundles `online-3d-viewer` npm package v0.16.0\n- The upstream [Online3DViewer](https://github.com/kovacsv/Online3DViewer) library is the root cause\n\n## Severity\n\n- Stored XSS: the payload persists in the repository and fires on every page view\n- Executes under the Gitea origin with the victim's session (cookies, CSRF tokens)\n- Any authenticated user viewing the file is compromised\n- Enables full account takeover (token creation, settings modification, repository manipulation)\n- No user interaction beyond viewing the file page is required\n\n## Details\n\n### Root Cause\n\nWhen Online3DViewer parses a glTF file, it checks whether all `extensionsRequired` entries are supported. For unsupported extensions, it calls:\n\n```javascript\n// In the Online3DViewer bundle (online-3d-viewer.js)\n// Approximate offset 1142618 in the bundled chunk\nthis.SetError(yp(\"Unsupported extension: {0}.\", unsupportedExtensions.join(\", \")));\n```\n\nThe `SetError` method stores this message, and Gitea's rendering code inserts it into the page using `innerHTML`:\n\n```javascript\n// Gitea's error display handler\nelement.innerHTML = errorMessage;  // unsanitized\n```\n\nThe extension names from `extensionsRequired` are taken directly from the JSON file with no escaping or sanitization, allowing HTML injection.\n\n### Attack Vector\n\n1. An attacker creates a `.gltf` file with a malicious `extensionsRequired` value:\n\n```json\n{\n  \"asset\": {\"version\": \"2.0\"},\n  \"buffers\": [],\n  \"extensionsRequired\": [\"<img src=x onerror=\\\"alert(document.cookie)\\\">\"],\n  \"scenes\": []\n}\n```\n\n2. The attacker pushes this file to any Gitea repository they have write access to (including forks of public repositories).\n\n3. When any user navigates to the file's page in the Gitea web UI, the 3D viewer attempts to render it, encounters the \"unsupported extension,\" and inserts the error message (containing the attacker's HTML) into the DOM via `innerHTML`.\n\n4. The injected `<img onerror>` handler executes arbitrary JavaScript under the Gitea origin with the victim's authenticated session.\n\n### Impact\n\nFrom the XSS context, an attacker can:\n\n- **Create API access tokens** for the victim by POSTing to `/user/settings/applications` with the page's CSRF token\n- **Read private repositories** via same-origin API calls\n- **Modify repository contents** (supply chain attacks)\n- **Escalate to admin** if the victim is a Gitea administrator\n- **Exfiltrate data** via `fetch`, `XMLHttpRequest`, or `navigator.sendBeacon`\n\n## Proof of Concept\n\n### Minimal PoC (alert box)\n\nSave as `poc.gltf` and push to any Gitea 1.25+ repository:\n\n```json\n{\n  \"asset\": {\"version\": \"2.0\"},\n  \"buffers\": [],\n  \"extensionsRequired\": [\"<img src=x onerror=\\\"alert('XSS: '+document.domain)\\\">\"],\n  \"scenes\": []\n}\n```\n\nNavigate to the file in the Gitea web UI. The alert will fire.\n\n\n## Suggested Fixes\n\nSanitize or text-encode the error message before DOM insertion. Replace `innerHTML` with `textContent` for error display:\n\n```javascript\n// Instead of:\nelement.innerHTML = errorMessage;\n\n// Use:\nelement.textContent = errorMessage;\n```\n\nAlternatively, escape HTML entities in the error message before insertion.\n\n### Additional hardening\n\n- Render 3D file previews inside a sandboxed `<iframe>` with `sandbox=\"allow-scripts\"` and a restrictive CSP (`default-src 'none'`), similar to how Gitea already handles SVG attachments\n- Apply Content-Security-Policy headers to file preview pages that restrict inline script execution","state":0,"publishedAt":"2026-06-17T18:10:19+00:00","modifiedAt":"2026-06-25T19:56:26.5288258+00:00","affected":[{"ecosystem":"Go","name":"code.gitea.io/gitea","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.25.0"},{"kind":"fixed","version":"1.26.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/go-gitea/gitea/security/advisories/GHSA-9cpj-qc93-vw8v","https://github.com/go-gitea/gitea"],"sourceUrl":"https://github.com/advisories/GHSA-9cpj-qc93-vw8v","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-9cpj-qc93-vw8v","identifiers":["GHSA-9cpj-qc93-vw8v","CVE-2026-28737","GO-2026-5286"]},"retained":false,"historicalAffected":[]},{"revision":"dac8f6f9484d4d6da938e4a283554781","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-5286","aliases":["CVE-2026-28737","GHSA-9cpj-qc93-vw8v"],"title":"Gitea: Stored XSS via glTF `extensionsRequired` in Gitea 3D File Viewer in code.gitea.io/gitea","description":"Gitea: Stored XSS via glTF `extensionsRequired` in Gitea 3D File Viewer in code.gitea.io/gitea","state":0,"publishedAt":"2026-06-25T18:43:19+00:00","modifiedAt":"2026-06-25T19:45:26.3043814+00:00","affected":[{"ecosystem":"Go","name":"code.gitea.io/gitea","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.25.0"},{"kind":"fixed","version":"1.26.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/go-gitea/gitea/security/advisories/GHSA-9cpj-qc93-vw8v"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-5286","license":"OSV · upstream source license applies","key":"osv:GO-2026-5286","identifiers":["GO-2026-5286","CVE-2026-28737","GHSA-9cpj-qc93-vw8v"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-07T21:52:16.7895348+00:00","complete":true,"records":1769,"lastAttemptAt":"2026-11-07T21:52:16.7895348+00:00","lastSuccessAt":"2026-11-07T21:52:17.018923+00:00","error":null,"lastVerifiedAt":"2026-11-07T21:52:17.0189237+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-bb5c9d5a08063ef076042e33dd72a7d0ffa4c4487efdcf3106e29ba55ec2ad57-5978693a555a2fac0feee4f8e1cdc5e013b9a91b16046d4e34ae63a3d3db8d19","complete":true,"records":420947,"lastAttemptAt":"2026-11-07T21:52:16.4606105+00:00","lastSuccessAt":"2026-11-07T21:52:16.3995215+00:00","error":null,"lastVerifiedAt":"2026-11-07T21:52:16.4606105+00:00","snapshotPublishedAt":"2026-11-07T21:18:20+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-c91a0736a9624a48aebf081ca5dd86b2","complete":true,"records":13633,"lastAttemptAt":"2026-11-07T22:04:27.1191985+00:00","lastSuccessAt":"2026-11-07T22:04:27.115+00:00","error":null,"lastVerifiedAt":"2026-11-07T22:04:27.115+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-07T21:52:16.7895348+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-07T21:52:16.7895348+00:00","lastSuccessAt":"2026-11-07T21:52:17.0199092+00:00","error":null,"lastVerifiedAt":"2026-11-07T21:52:17.0199095+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-2b22c2d15f834007aa54c93f73b8deaf","complete":true,"records":13645,"lastAttemptAt":"2026-11-07T21:52:42.2590883+00:00","lastSuccessAt":"2026-11-07T21:52:42.255+00:00","error":null,"lastVerifiedAt":"2026-11-07T21:52:42.255+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-0eb4d6dde62dffacd040ad992d4fd5a65cd7d0dc5f5f4cfa8b41967fc6f9ca5f","complete":true,"records":9914,"lastAttemptAt":"2026-11-07T21:52:16.7352005+00:00","lastSuccessAt":"2026-11-06T20:10:36.6450506+00:00","error":null,"lastVerifiedAt":"2026-11-07T21:52:16.7352005+00:00","snapshotPublishedAt":"2026-11-06T20:02:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-fde804134ecdda0ddd5ff5c26ee1fff5a6fa659311f7ef2e51c6ad54964db0e2","complete":true,"records":1971,"lastAttemptAt":"2026-11-07T21:52:16.5087916+00:00","lastSuccessAt":"2026-11-06T19:03:17.0399903+00:00","error":null,"lastVerifiedAt":"2026-11-07T21:52:16.5087916+00:00","snapshotPublishedAt":"2026-11-06T18:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-335633e78a15c9cde10a6025895b5617717087fb945489ae7e15d377bacf34a9","complete":true,"records":3055,"lastAttemptAt":"2026-11-07T21:52:16.7531721+00:00","lastSuccessAt":"2026-11-06T16:03:00.7615789+00:00","error":null,"lastVerifiedAt":"2026-11-07T21:52:16.7531721+00:00","snapshotPublishedAt":"2026-11-06T16:02:48+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-40ad6183a951565ace1520a9b4d631e1d0bfb1d4bf7c5574c375032559f3ff53","complete":true,"records":231292,"lastAttemptAt":"2026-11-07T21:52:16.6283313+00:00","lastSuccessAt":"2026-11-07T10:29:00.4821259+00:00","error":null,"lastVerifiedAt":"2026-11-07T21:52:16.6283313+00:00","snapshotPublishedAt":"2026-11-07T09:32:47+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}