Vulnerability · Published Mar 5, 2026 · Assigned by GitHub_M

CVE-2026-26194Gogs: Release tag option injection in release deletion

High 8.8

In plain English

A high-severity argument injection in gogs from gogs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)8.8High

Exploit odds (30 days)0.5%top 54.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Gogs is an open source self-hosted Git service. Prior to version 0.14.2, there's a security issue in gogs where deleting a release can fail if a user controlled tag name is passed to git without the right separator, this lets git options get injected and mess with the process. This issue has been patched in version 0.14.2.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	gogs.io/gogs	0.14.2	GHSA-v9vm-r24h-6rqm
Go	gogs.io/gogs	no fix listed	GO-2026-4617

Affected products (as reported)

Vendor	Product	Versions
gogs	gogs	< 0.14.2

Weakness: CWE-88 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N

References

https://github.com/gogs/gogs/security/advisories/GHSA-v9vm-r24h-6rqm x_refsource_CONFIRM
https://github.com/gogs/gogs/pull/8175 x_refsource_MISC
https://github.com/gogs/gogs/commit/a000f0c7a632ada40e6829abdeea525db4c0fc2d x_refsource_MISC
https://github.com/gogs/gogs/releases/tag/v0.14.2 x_refsource_MISC