CVE-2026-120729

The Gitea platform is vulnerable to a stored cross-site scripting (XSS) flaw in the issue reference popup. The vulnerability occurs because the popup loads data from the hovered link's path and inserts the response as HTML . An attacker capable of posting comments can provide a link pointing to a...