{"schema_version":"1.9.0","id":"GHSA-v9vm-r24h-6rqm","published":"2026-03-05T19:29:44Z","modified":"2026-03-23T04:56:23.729145982Z","aliases":["CVE-2026-26194","GO-2026-4617"],"summary":"Gogs: Release tag option injection in release deletion","details":"### Summary\n\nThere is a security issue in Gogs where deleting a release can fail if a user-controlled tag name is passed to Git without the right separator, allowing Git option injection and therefore interfering with the process.\n\n### Affected Component\n\n  - internal/database/release.go\n    `process.ExecDir(..., \"git\", \"tag\", \"-d\", rel.TagName)`\n\n### Details\n\n  `rel.TagName` is used as a CLI argument to `git tag -d` without `--` or `--end-of-options`.\n  If the tag name begins with `-`, Git parses it as a flag.\n\n  The prior mitigation is incomplete. There is path sanitization in place during creation:\n\n  - internal/database/release.go\n    `r.TagName = strings.TrimLeft(r.TagName, \"-\")`\n\n  But it only covers one creation path and does not reliably protect tag deletions, such as tags added through `git push` or ref updates.\n\n**Exploit Conditions**\n1. An attacker can add a tag name that starts with a dash into the repository.\n2. A user with permission to delete releases triggers it through the web UI or API.\n\n### Recommended Fix\n\n1. Add end-of-options in release deletion:\n      - `git tag -d -- <tagName>`\n2. It is better to use the safe git-module deletion helper since it handles options properly.\n3. All Git commands should be audited for user input, ensuring that the end-of-options separator is always used.\n\n### Impact\n  - Option injection into `git tag -d`\n  - Tag/release deletion can fail or behave unexpectedly\n  - Operational denial of service in release cleanup workflows\n  - Potential release metadata inconsistency","affected":[{"package":{"name":"gogs.io/gogs","ecosystem":"Go","purl":"pkg:golang/gogs.io/gogs"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.14.2"}]}],"database_specific":{"last_known_affected_version_range":"<= 0.14.1","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-v9vm-r24h-6rqm/GHSA-v9vm-r24h-6rqm.json"}}],"references":[{"type":"WEB","url":"https://github.com/gogs/gogs/security/advisories/GHSA-v9vm-r24h-6rqm"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-26194"},{"type":"WEB","url":"https://github.com/gogs/gogs/pull/8175"},{"type":"WEB","url":"https://github.com/gogs/gogs/commit/a000f0c7a632ada40e6829abdeea525db4c0fc2d"},{"type":"PACKAGE","url":"https://github.com/gogs/gogs"},{"type":"WEB","url":"https://github.com/gogs/gogs/releases/tag/v0.14.2"}],"database_specific":{"cwe_ids":["CWE-88"],"github_reviewed":true,"github_reviewed_at":"2026-03-05T19:29:44Z","nvd_published_at":"2026-03-05T19:16:03Z","severity":"HIGH"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N"}]}