CVE-2026-59102: Forgejo Stored XSS in Actions via Full Name Injection

Technical summary

The vulnerability exists in Forgejo's Actions feature when the DEFAULT_SHOW_FULL_NAME configuration option is enabled. The attack chain involves: (1) an authenticated attacker setting a full name field with an embedded HTML/JavaScript payload; (2) triggering an Actions run that generates a run description; (3) the server-side translation function interpolating the attacker's display name into an HTML string without escaping it; (4) the frontend Vue component using v-html directive to render the unsanitized description; (5) arbitrary JavaScript execution in the context of any user viewing the affected run page. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation).

Business impact

This stored XSS can lead to account compromise, credential theft, and lateral movement within the Forgejo instance. An attacker with legitimate access can craft a payload that steals session tokens or administrative credentials from other users who view the Actions run page. In organizations relying on Forgejo for source control and CI/CD, this could compromise the integrity of builds, commits, and deployments. The scope is marked as 'Changed' because the vulnerability affects other users, not just the attacker.

Affected systems

Forgejo versions prior to 15.0.3 are vulnerable when the DEFAULT_SHOW_FULL_NAME configuration option is enabled. Organizations running Forgejo should determine their current version and check whether this configuration setting is active in their deployment.

Exploitability

Exploitation requires valid authentication to the Forgejo instance and user interaction (a victim must view the malicious Actions run page). The attack vector is network-based and does not require special privileges—any authenticated user can set their display name and trigger a run. The CVSS score of 5.4 (Medium) reflects these factors: low complexity, but limited immediate impact (reading and modifying data visible to other users, no availability impact).

Remediation

Upgrade Forgejo to version 15.0.3 or later. Organizations unable to patch immediately should consider disabling the DEFAULT_SHOW_FULL_NAME option if operationally feasible, which prevents the vulnerable code path from executing. Review any Actions run pages that may have been viewed by multiple users to assess potential exposure.

Patch guidance

Apply the upgrade to Forgejo 15.0.3 or a later patched release following your organization's change management procedures. Verify the upgrade in a staging environment first, particularly if you have custom configurations or workflows dependent on the DEFAULT_SHOW_FULL_NAME setting. Coordinate patching with your development and CI/CD teams to minimize disruption.

Detection guidance

Search Forgejo user accounts for full names containing HTML or script tags (e.g., <script>, <img onerror=, onclick=, javascript:). Review Actions run descriptions generated by users with suspicious full names or created around the time of potential compromise. Monitor browser console errors on Actions run pages for signs of injected script execution. If your Forgejo instance has audit logging enabled, look for unusual full name updates followed by Actions run creation by the same user.

Why prioritize this

Although the CVSS score is Medium, prioritize this for patching because: (1) it requires only valid authentication and user interaction, making it exploitable by insiders or low-privilege users; (2) stored XSS in a CI/CD system can facilitate supply-chain attacks by compromising builds or deployments; (3) the scope crosses user boundaries, affecting all viewers of a run page; (4) upgrade to 15.0.3 is available and straightforward.

Risk score, explained

CVSS 5.4 reflects a network-based attack requiring authentication and user interaction (UI:R). Integrity and Confidentiality impact is Low because the attacker can read and modify information visible to authenticated users on the affected page, but cannot trigger denial of service or execute arbitrary system commands. The Medium severity is appropriate for an authenticated, stored XSS in a collaborative platform.

Frequently asked questions