CVE-2026-26194

Published: Mar 5, 2026Modified: Jun 17, 2026

8.8

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Show more

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: security-advisories@github.com (Secondary)

Description

Gogs is an open source self-hosted Git service. Prior to version 0.14.2, there's a security issue in gogs where deleting a release can fail if a user controlled tag name is passed to git without the right separator, this lets git options get injected and mess with the process. This issue has been patched in version 0.14.2.

Affected (1)

Products: Gogs: Gogs

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Gogs Gogs	Before 0.14.2

Related CWEs

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

References (4)

https://github.com/gogs/gogs/commit/a000f0c7a632ada40e6829abdeea525db4c0fc2d

Source: security-advisories@github.com

Patch

https://github.com/gogs/gogs/pull/8175

Source: security-advisories@github.com

Issue Tracking

https://github.com/gogs/gogs/releases/tag/v0.14.2

Source: security-advisories@github.com

Release Notes

https://github.com/gogs/gogs/security/advisories/GHSA-v9vm-r24h-6rqm

Source: security-advisories@github.com

ExploitMitigationVendor Advisory

Timeline

No history available yet.