{"id":"CVE-2021-28378","details":"Gitea 1.12.x and 1.13.x before 1.13.4 allows XSS via certain issue data in some situations.","aliases":["BIT-gitea-2021-28378","GHSA-g95p-88p4-76cm","GO-2022-0832"],"modified":"2025-11-14T11:35:06.339857Z","published":"2021-03-15T06:15:12.423Z","references":[{"type":"ADVISORY","url":"https://blog.gitea.io/2021/03/gitea-1.13.4-is-released/"},{"type":"EVIDENCE","url":"https://github.com/PandatiX/CVE-2021-28378"},{"type":"FIX","url":"https://github.com/go-gitea/gitea/pull/14898"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/go-gitea/gitea","events":[{"introduced":"03b7e11bd6125d4128cf99bc408723d1548f0613"},{"fixed":"75496b9ff507ca5e9b7665f888f1156485e6532d"}]}],"versions":["v1.13.0","v1.13.0-dev","v1.13.0-rc1","v1.13.0-rc2","v1.13.1","v1.13.2","v1.13.3"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-28378.json"}}],"schema_version":"1.7.3","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"}]}