{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "gogs.io/gogs"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.12.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-06-02T20:46:30Z",
    "nvd_published_at": null,
    "severity": "LOW"
  },
  "details": "### Impact\n\nThere is no known practical impact other than it is just possible to manipulate CSRF cookie and XSS the malicious user self.\n\n### Patches\n\nInvalid characters of CSRF tokens are stripped after reading cookie. Users should upgrade to 0.12.8 or the latest 0.13.0+dev.\n\n### Workarounds\n\nNo need for workarounds.\n\n### References\n\nN/A\n\n### For more information\n\nIf you have any questions or comments about this advisory, please post on https://github.com/gogs/gogs/issues/6953.\n",
  "id": "GHSA-pj96-4jhv-v792",
  "modified": "2022-06-02T20:46:30Z",
  "published": "2022-06-02T20:46:30Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/gogs/gogs/security/advisories/GHSA-pj96-4jhv-v792"
    },
    {
      "type": "WEB",
      "url": "https://github.com/gogs/gogs/issues/6953"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/gogs/gogs"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [],
  "summary": "Cross site scripting via cookies in gogs"
}