CVE-2025-68946
Moderate
Gitea vulnerable to Cross-site Scripting in code.gitea.io/gitea
Gitea vulnerable to Cross-site Scripting in code.gitea.io/gitea
Exploit probability
0.2%
Published
December 30, 2025
Required by
Not available
Last source change
March 3, 2026
02 / AFFECTED SOFTWARE
Affected packages
6 explicit affected versions
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
Open Source Vulnerabilities
CVE-2025-68946
View original source
In Gitea before 1.20.1, a forbidden URL scheme such as javascript: can be used for a link, aka XSS.
Open Source Vulnerabilities
GO-2025-4265
View original source
Gitea vulnerable to Cross-site Scripting in code.gitea.io/gitea
Open Source Vulnerabilities
BIT-gitea-2025-68946
View original source
In Gitea before 1.20.1, a forbidden URL scheme such as javascript: can be used for a link, aka XSS.
Open Source Vulnerabilities
GHSA-hq57-c72x-4774
View original source
In Gitea before 1.20.1, a forbidden URL scheme such as javascript: can be used for a link, aka XSS.
05 / REFERENCES
Further evidence
- https://blog.gitea.com/release-of-1.20.1/
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68946.json
- https://github.com/go-gitea/gitea/pull/25960
- https://github.com/go-gitea/gitea/releases/tag/v1.20.1
- https://nvd.nist.gov/vuln/detail/CVE-2025-68946
- https://blog.gitea.com/release-of-1.20.1
- https://github.com/advisories/GHSA-hq57-c72x-4774
- https://github.com/go-gitea/gitea