Listen to this Post
Gogs before version 0.14.2 contains an injection vulnerability during the release deletion process. When a user initiates the deletion of a release, the application passes the associated tag name to a Git command. Due to the lack of a proper separator (such as “–“) between the command and the user-controlled tag name, an attacker can inject additional command-line options. By crafting a malicious tag name beginning with a hyphen, an attacker can pass arbitrary options to the Git executable, which can alter the command’s behavior, cause it to fail, or lead to information disclosure. This allows an attacker with the ability to create tags to manipulate the server-side Git process, potentially leading to unexpected states or leakage of repository data.
dailycve form:
Platform: Gogs
Version: <0.14.2
Vulnerability: Option injection
Severity: Medium
date: 03/05/2026
Prediction: 03/06/2026
What Undercode Say:
Analytics:
This vulnerability falls under CWE-88 (Improper Neutralization of Argument Delimiters in a Command). It is specific to Gogs’ release deletion feature and requires an authenticated user with the ability to create tags in a repository. The attack vector is network-based and has low complexity, as the injection is into a Git command’s arguments, not arbitrary OS commands.
Exploit:
Create a tag with a malicious name containing Git options The double hyphen is part of the tag name to test for separator injection git tag --annotate --message "Malicious tag" "--help" git push origin --tags Attempt to delete the release via Gogs UI or API to trigger the vulnerable command The injected '--help' option might cause Git to output its help text instead of deleting
Protection:
Upgrade to the patched version (0.14.2 or later) For Go installations go install gogs.io/[email protected] For Docker users docker pull gogs/gogs:0.14.2 docker stop <current_container> docker run --name=gogs -p 10022:22 -p 10080:3000 -v /var/gogs:/data gogs/gogs:0.14.2 Mitigation (if unable to patch immediately) Restrict tag creation permissions to trusted users only. In app.ini, consider disabling release deletion for non-admin users.
Impact:
Successful exploitation allows an attacker to pass unintended options to the Git binary executed by the server. This could lead to Git operations failing (denial of service), exposure of Git’s internal help or version information, or potentially altering the behavior of the repository management process. It does not directly lead to remote code execution but can disrupt service and leak information.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow DailyCVE & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin
Gogs, Stored XSS, CVE-2026-26195 (MEDIUM)