---
title: "CVE-2024-6886: Gitea Cross-site Scripting Vulnerability"
url: https://erroneo.us/security/cve/CVE-2024-6886/
description: "CVE-2024-6886 (code.gitea.io/gitea (Go)): Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gitea…"
type: vulnerability-record
section: "Security Digest"
date_published: 2024-08-06
date_modified: 2024-08-07
publisher: erroneo.us
author: erroneo.us Security Desk
cve: "CVE-2024-6886"
kev: false
cvss: 10
epss: 0.32968
license: All rights reserved. Quote with attribution and a link.
---

# CVE-2024-6886: Gitea Cross-site Scripting Vulnerability

**Signal:** High exploit likelihood. EPSS ranks it in the top 5% of all CVEs for likely exploitation in the next 30 days. (Computed from CISA KEV, EPSS and CVSS; not an editorial verdict.)

## Should you act?

- No confirmed exploitation. It is not in CISA’s KEV catalog and CISA’s SSVC assessment records no known exploitation. That can change quickly after a public write-up; re-check if you are affected.
- EPSS 33.0% , percentile 98: FIRST’s model estimates a 33.0% chance of exploitation activity in the next 30 days, higher than 98% of all scored CVEs (very high). EPSS is a probability, not a verdict.
- Remotely reachable with no login and no user interaction. If the vulnerable service is exposed to the internet, prioritize it.
- Only applies if your dependency tree includes code.gitea.io/gitea (Go) < 1.22.1, fixed in 1.22.1 . Check your lockfile, including transitive dependencies.

## What it is

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gitea Gitea Open Source Git Server allows Stored XSS.This issue affects Gitea Open Source Git Server: 1.22.0.

## Affected packages

- Go `code.gitea.io/gitea` < 1.22.1 → fixed: 1.22.1

## Affected products (CVE record)

- Gitea Gitea Open Source Git Server: 1.22.0

## Severity

- Gitea CVSS 4.0: 10 `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H`
- GitHub CVSS 4.0: 10.0 `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`

## Exploitation

- CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
- CISA SSVC assessment: exploitation none , automatable yes , technical impact total .
- FIRST EPSS (model of 2026-10-21): 32.97% probability of exploitation activity in the next 30 days; percentile 98.

## Sources

- [GitHub Advisory GHSA-4h4p-553m-46qh](https://github.com/advisories/GHSA-4h4p-553m-46qh)
- [CVE.org record CVE-2024-6886](https://www.cve.org/CVERecord?id=CVE-2024-6886)
- [NVD entry CVE-2024-6886](https://nvd.nist.gov/vuln/detail/CVE-2024-6886)
- [github.com](https://github.com/go-gitea/gitea/pull/31200)
- [blog.gitea.com](https://blog.gitea.com/release-of-1.22.1/)
- [github.com](https://github.com/go-gitea/gitea/commit/b6280f4d21309cfae7cc07f74173354c664d5e10)
- [pkg.go.dev](https://pkg.go.dev/vuln/GO-2024-3056)

---
Source page: https://erroneo.us/security/cve/CVE-2024-6886/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt