Gogs: Release tag option injection in release deletion in gogs.io/gogs

Open Source Vulnerabilities CVE-2026-26194

Gogs is an open source self-hosted Git service. Prior to version 0.14.2, there's a security issue in gogs where deleting a release can fail if a user controlled tag name is passed to git without the right separator, this lets git options get injected and mess with the process. This issue has been patched in version 0.14.2.

Open Source Vulnerabilities GHSA-v9vm-r24h-6rqm

### Summary There is a security issue in Gogs where deleting a release can fail if a user-controlled tag name is passed to Git without the right separator, allowing Git option injection and therefore interfering with the process. ### Affected Component - internal/database/release.go `process.ExecDir(..., "git", "tag", "-d", rel.TagName)` ### Details `rel.TagName` is used as a CLI argument to `git tag -d` without `--` or `--end-of-options`. If the tag name begins with `-`, Git parses it as a flag. The prior mitigation is incomplete. There is path sanitization in place during creation: - internal/database/release.go `r.TagName = strings.TrimLeft(r.TagName, "-")` But it only covers one creation path and does not reliably protect tag deletions, such as tags added through `git push` or ref updates. **Exploit Conditions** 1. An attacker can add a tag name that starts with a dash into the repository. 2. A user with permission to delete releases triggers it through the web UI or API. ### Recommended Fix 1. Add end-of-options in release deletion: - `git tag -d -- <tagName>` 2. It is better to use the safe git-module deletion helper since it handles options properly. 3. All Git commands should be audited for user input, ensuring that the end-of-options separator is always used. ### Impact - Option injection into `git tag -d` - Tag/release deletion can fail or behave unexpectedly - Operational denial of service in release cleanup workflows - Potential release metadata inconsistency

Open Source Vulnerabilities GO-2026-4617

Gogs: Release tag option injection in release deletion in gogs.io/gogs. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: gogs.io/gogs before v0.14.2.