CVE-2026-26194CWE-88

Gogs: Release tag option injection in release deletion

High · published March 5, 2026

CVSS v4.0
8.8
EPSS
1%
Percentile
45.4
In the wild
Unconfirmed
What it is

Gogs is an open source self-hosted Git service. Prior to version 0.14.2, there's a security issue in gogs where deleting a release can fail if a user controlled tag name is passed to git without the right separator, this lets git options get injected and mess with the process. This issue has been patched in version 0.14.2.

The record
Technical detail
CVSS v4.0
8.8 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00552 · 45.4th percentile
Weakness
CWE-88 · Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Published
2026-03-05T18:38Z
EPSS history
Timeline
  • 05 MAR 18:38Z
    Gogs: Release tag option injection in release deletion
    cvelistv5