CVE-2022-31038

Gogs is an open source self-hosted Git service. In versions of gogs prior to 0.12.9 `DisplayName` does not filter characters input from users, which leads to an XSS vulnerability when directly displayed in the issue list. This issue has been resolved in commit 155cae1d which sanitizes `DisplayName` prior to display to the user. All users of gogs are advised to upgrade. Users unable to upgrade should check their users' display names for malicious characters.

• CWE-79

• https://github.com/gogs/gogs/commit/155cae1de8916fc3fde78f350763034b7422caeePatch, Third Party Advisory
• https://github.com/gogs/gogs/pull/7009Issue Tracking, Third Party Advisory
• https://github.com/gogs/gogs/security/advisories/GHSA-xq4v-vrp9-vcf2Issue Tracking, Third Party Advisory
• https://github.com/gogs/gogs/commit/155cae1de8916fc3fde78f350763034b7422caeePatch, Third Party Advisory
• https://github.com/gogs/gogs/pull/7009Issue Tracking, Third Party Advisory
• https://github.com/gogs/gogs/security/advisories/GHSA-xq4v-vrp9-vcf2Issue Tracking, Third Party Advisory

Published

Jun 9, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-31032Tuleap is a Free & Open Source Suite to improve management o…4.3
• CVE-2022-31033The Mechanize library is used for automating interaction wit…7.5
• CVE-2022-31034Argo CD is a declarative, GitOps continuous delivery tool fo…8.1
• CVE-2022-31035Argo CD is a declarative, GitOps continuous delivery tool fo…5.4
• CVE-2022-31036Argo CD is a declarative, GitOps continuous delivery tool fo…4.3
• CVE-2022-31037OroCommerce is an open-source Business to Business Commerce …5.4
• CVE-2022-31039Greenlight is a simple front-end interface for your BigBlueB…5.3
• CVE-2022-3104An issue was discovered in the Linux kernel through 5.16-rc6…5.5
• CVE-2022-31040Open Forms is an application for creating and publishing sma…6.1
• CVE-2022-31041Open Forms is an application for creating and publishing sma…6.5
• CVE-2022-31042Guzzle is an open source PHP HTTP client. In affected versio…7.5
• CVE-2022-31043Guzzle is an open source PHP HTTP client. In affected versio…7.5