### Summary

Stored XSS is still possible through unsafe template rendering that mixes user input with `safe()` plus permissive sanitizer handling of data URLs.

### Details

`safe()` still turns off escaping:
- internal/template/template.go
- `func safe(raw string) template.HTML { return template.HTML(raw) }`

Branch pages still render committer names using `safe()`:
- templates/repo/branches/overview.tmpl
- templates/repo/branches/all.tmpl
- templates/repo/wiki/view.tmpl

The locale still injects a raw second argument: conf/locale/locale_en-US.ini (`branches.updated_by = updated %[1]s by %[2]s`)

### Impact

An attacker who can inject commit metadata such as author/committer name can trigger script execution on affected pages, leading to session abuse, CSRF token theft, or unauthorized actions.

### Recommended Fix

- Untrusted arguments should be escaped before being used in translations.
- Data URLs should be limited or blocked in the sanitizer.

### Remediation
A fix is available at https://github.com/gogs/gogs/releases/tag/v0.14.2.

CWE-79 Cross-site Scripting (XSS)