{"id":"CVE-2026-26194","aliases":["GHSA-v9vm-r24h-6rqm","GO-2026-4617"],"url":"https://o3.security/vulnerability/CVE-2026-26194","summary":"Gogs: Release tag option injection in release deletion","details":"### Summary\n\nThere is a security issue in Gogs where deleting a release can fail if a user-controlled tag name is passed to Git without the right separator, allowing Git option injection and therefore interfering with the process.\n\n### Affected Component\n\n  - internal/database/release.go\n    `process.ExecDir(..., \"git\", \"tag\", \"-d\", rel.TagName)`\n\n### Details\n\n  `rel.TagName` is used as a CLI argument to `git tag -d` without `--` or `--end-of-options`.\n  If the tag name begins with `-`, Git parses it as a flag.\n\n  The prior mitigation is incomplete. There is path sanitization in place during creation:\n\n  - internal/database/release.go\n    `r.TagName = strings.TrimLeft(r.TagName, \"-\")`\n\n  But it only covers one creation path and does not reliably protect tag deletions, such as tags added through `git push` or ref updates.\n\n**Exploit Conditions**\n1. An attacker can add a tag name that starts with a dash into the repository.\n2. A user with permission to delete releases triggers it through the web UI or API.\n\n### Recommended Fix\n\n1. Add end-of-options in release deletion:\n      - `git tag -d -- <tagName>`\n2. It is better to use the safe git-module deletion helper since it handles options properly.\n3. All Git commands should be audited for user input, ensuring that the end-of-options separator is always used.\n\n### Impact\n  - Option injection into `git tag -d`\n  - Tag/release deletion can fail or behave unexpectedly\n  - Operational denial of service in release cleanup workflows\n  - Potential release metadata inconsistency","published":"2026-03-05T18:38:38.860Z","modified":"2026-08-12T03:51:17.512440998Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"gogs.io/gogs","fixedVersion":"0.14.2"}],"fix":{"url":"https://github.com/gogs/gogs/commit/a000f0c7a632ada40e6829abdeea525db4c0fc2d","label":"gogs/gogs@a000f0c"},"references":[{"type":"WEB","url":"https://github.com/gogs/gogs/releases/tag/v0.14.2"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26194.json"},{"type":"ADVISORY","url":"https://github.com/gogs/gogs/security/advisories/GHSA-v9vm-r24h-6rqm"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-26194"},{"type":"FIX","url":"https://github.com/gogs/gogs/commit/a000f0c7a632ada40e6829abdeea525db4c0fc2d"},{"type":"FIX","url":"https://github.com/gogs/gogs/pull/8175"},{"type":"PACKAGE","url":"https://github.com/gogs/gogs"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:17.512440998Z"}}