CVE-2025-68946 - OpenCVE

In Gitea before 1.20.1, a forbidden URL scheme such as javascript: can be used for a link, aka XSS.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Gitea	Gitea

No data.

No data.

References

Link	Providers
https://blog.gitea.com/release-of-1.20.1/
https://github.com/go-gitea/gitea/pull/25960
https://github.com/go-gitea/gitea/releases/tag/v1.20.1
https://nvd.nist.gov/vuln/detail/CVE-2025-68946
https://www.cve.org/CVERecord?id=CVE-2025-68946

History

Sat, 27 Dec 2025 00:15:00 +0000

Type	Values Removed	Values Added
Title		gitea: Gitea: Cross-Site Scripting (XSS) via forbidden URL scheme in links
References		https://nvd.nist.gov/vuln/detail/CVE-2025-68946 https://www.cve.org/CVERecord?id=CVE-2025-68946
Metrics	threat_severity `None`	threat_severity `Moderate`

Fri, 26 Dec 2025 15:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Fri, 26 Dec 2025 04:30:00 +0000

Type	Values Removed	Values Added
Description		In Gitea before 1.20.1, a forbidden URL scheme such as javascript: can be used for a link, aka XSS.
First Time appeared		Gitea Gitea gitea
Weaknesses		CWE-79
CPEs		cpe:2.3:a:gitea:gitea::::::::
Vendors & Products		Gitea Gitea gitea
References		https://blog.gitea.com/release-of-1.20.1/ https://github.com/go-gitea/gitea/pull/25960 https://github.com/go-gitea/gitea/releases/tag/v1.20.1
Metrics		cvssV3_1 `{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N'}`

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2025-12-26T04:14:03.775Z

Updated: 2025-12-26T18:59:45.647Z

Reserved: 2025-12-26T04:14:03.512Z

Link: CVE-2025-68946

Vulnrichment

Updated: 2025-12-26T14:42:19.409Z

NVD

Status : Received

Published: 2025-12-26T05:16:11.590

Modified: 2025-12-26T05:16:11.590

Link: CVE-2025-68946

Redhat

Severity : Moderate

Publid Date: 2025-12-26T04:14:03Z

Links: CVE-2025-68946 - Bugzilla

{"dataType": "CVE_RECORD", "cveMetadata": {"cveId": "CVE-2025-68946", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "state": "PUBLISHED", "assignerShortName": "mitre", "dateReserved": "2025-12-26T04:14:03.512Z", "datePublished": "2025-12-26T04:14:03.775Z", "dateUpdated": "2025-12-26T18:59:45.647Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "packageURL": "pkg:golang/code.gitea.io/gitea", "product": "Gitea", "vendor": "Gitea", "versions": [{"lessThan": "1.20.1", "status": "affected", "version": "1.20.0", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*", "versionStartIncluding": "1.20.0", "versionEndExcluding": "1.20.1"}]}]}], "descriptions": [{"lang": "en", "value": "In Gitea before 1.20.1, a forbidden URL scheme such as javascript: can be used for a link, aka XSS."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2025-12-26T18:59:45.647Z"}, "references": [{"url": "https://blog.gitea.com/release-of-1.20.1/"}, {"url": "https://github.com/go-gitea/gitea/releases/tag/v1.20.1"}, {"url": "https://github.com/go-gitea/gitea/pull/25960"}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-26T14:42:13.330951Z", "id": "CVE-2025-68946", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-26T14:50:45.662Z"}}]}, "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-68946", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-26T14:42:13.330951Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-26T14:42:19.409Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Gitea", "product": "Gitea", "versions": [{"status": "affected", "version": "1.20.0", "lessThan": "1.20.1", "versionType": "semver"}], "packageURL": "pkg:golang/code.gitea.io/gitea", "defaultStatus": "unaffected"}], "references": [{"url": "https://blog.gitea.com/release-of-1.20.1/"}, {"url": "https://github.com/go-gitea/gitea/releases/tag/v1.20.1"}, {"url": "https://github.com/go-gitea/gitea/pull/25960"}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}, "descriptions": [{"lang": "en", "value": "In Gitea before 1.20.1, a forbidden URL scheme such as javascript: can be used for a link, aka XSS."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "1.20.1", "versionStartIncluding": "1.20.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2025-12-26T18:59:45.647Z"}}}, "cveMetadata": {"cveId": "CVE-2025-68946", "state": "PUBLISHED", "dateUpdated": "2025-12-26T18:59:45.647Z", "dateReserved": "2025-12-26T04:14:03.512Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2025-12-26T04:14:03.775Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"bugzilla": {"description": "gitea: Gitea: Cross-Site Scripting (XSS) via forbidden URL scheme in links", "id": "2425468", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2425468"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.4", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "status": "draft"}, "cwe": "CWE-79", "details": ["A flaw was found in Gitea. A remote attacker could exploit this vulnerability by injecting a forbidden URL scheme, such as `javascript:`, into a link. This could lead to Cross-Site Scripting (XSS), allowing the attacker to execute arbitrary code in the user's browser or disclose sensitive information."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2025-68946", "package_state": [{"cpe": "cpe:/a:redhat:openshift_pipelines:1", "fix_state": "Not affected", "package_name": "openshift-pipelines/pipelines-pipelines-as-code-cli-rhel8", "product_name": "OpenShift Pipelines"}, {"cpe": "cpe:/a:redhat:openshift_pipelines:1", "fix_state": "Not affected", "package_name": "openshift-pipelines/pipelines-pipelines-as-code-cli-rhel9", "product_name": "OpenShift Pipelines"}, {"cpe": "cpe:/a:redhat:openshift_pipelines:1", "fix_state": "Not affected", "package_name": "openshift-pipelines/pipelines-pipelines-as-code-controller-rhel8", "product_name": "OpenShift Pipelines"}, {"cpe": "cpe:/a:redhat:openshift_pipelines:1", "fix_state": "Not affected", "package_name": "openshift-pipelines/pipelines-pipelines-as-code-controller-rhel9", "product_name": "OpenShift Pipelines"}, {"cpe": "cpe:/a:redhat:openshift_pipelines:1", "fix_state": "Not affected", "package_name": "openshift-pipelines/pipelines-pipelines-as-code-watcher-rhel8", "product_name": "OpenShift Pipelines"}, {"cpe": "cpe:/a:redhat:openshift_pipelines:1", "fix_state": "Not affected", "package_name": "openshift-pipelines/pipelines-pipelines-as-code-watcher-rhel9", "product_name": "OpenShift Pipelines"}, {"cpe": "cpe:/a:redhat:openshift_pipelines:1", "fix_state": "Not affected", "package_name": "openshift-pipelines/pipelines-pipelines-as-code-webhook-rhel8", "product_name": "OpenShift Pipelines"}, {"cpe": "cpe:/a:redhat:openshift_pipelines:1", "fix_state": "Not affected", "package_name": "openshift-pipelines/pipelines-pipelines-as-code-webhook-rhel9", "product_name": "OpenShift Pipelines"}], "public_date": "2025-12-26T04:14:03Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-68946\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-68946\nhttps://blog.gitea.com/release-of-1.20.1/\nhttps://github.com/go-gitea/gitea/pull/25960\nhttps://github.com/go-gitea/gitea/releases/tag/v1.20.1"], "statement": "This vulnerability is rated Moderate. In the Red Hat context, all listed OpenShift Pipelines components are not affected as the vulnerable code is not present.", "threat_severity": "Moderate"}