Publish GHSA-v9vm-r24h-6rqm

Author: advisory-database[bot]

advisories/github-reviewed/2026/03/GHSA-v9vm-r24h-6rqm/GHSA-v9vm-r24h-6rqm.json

@@ -0,0 +1,72 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-v9vm-r24h-6rqm",
+  "modified": "2026-03-05T19:29:44Z",
+  "published": "2026-03-05T19:29:44Z",
+  "aliases": [
+    "CVE-2026-26194"
+  ],
+  "summary": "Gogs: Release tag option injection in release deletion",
+  "details": "### Summary\n\nThere is a security issue in Gogs where deleting a release can fail if a user-controlled tag name is passed to Git without the right separator, allowing Git option injection and therefore interfering with the process.\n\n### Affected Component\n\n  - internal/database/release.go\n    `process.ExecDir(..., \"git\", \"tag\", \"-d\", rel.TagName)`\n\n### Details\n\n  `rel.TagName` is used as a CLI argument to `git tag -d` without `--` or `--end-of-options`.\n  If the tag name begins with `-`, Git parses it as a flag.\n\n  The prior mitigation is incomplete. There is path sanitization in place during creation:\n\n  - internal/database/release.go\n    `r.TagName = strings.TrimLeft(r.TagName, \"-\")`\n\n  But it only covers one creation path and does not reliably protect tag deletions, such as tags added through `git push` or ref updates.\n\n**Exploit Conditions**\n1. An attacker can add a tag name that starts with a dash into the repository.\n2. A user with permission to delete releases triggers it through the web UI or API.\n\n### Recommended Fix\n\n1. Add end-of-options in release deletion:\n      - `git tag -d -- <tagName>`\n2. It is better to use the safe git-module deletion helper since it handles options properly.\n3. All Git commands should be audited for user input, ensuring that the end-of-options separator is always used.\n\n### Impact\n  - Option injection into `git tag -d`\n  - Tag/release deletion can fail or behave unexpectedly\n  - Operational denial of service in release cleanup workflows\n  - Potential release metadata inconsistency",
+  "severity": [
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Go",
+        "name": "gogs.io/gogs"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "0.14.2"
+            }
+          ]
+        }
+      ],
+      "database_specific": {
+        "last_known_affected_version_range": "<= 0.14.1"
+      }
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/gogs/gogs/security/advisories/GHSA-v9vm-r24h-6rqm"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/gogs/gogs/pull/8175"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/gogs/gogs/commit/a000f0c7a632ada40e6829abdeea525db4c0fc2d"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/gogs/gogs"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/gogs/gogs/releases/tag/v0.14.2"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-88"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": true,
+    "github_reviewed_at": "2026-03-05T19:29:44Z",
+    "nvd_published_at": null
+  }
+}