CVE-2026-26194: Gogs Release Tag Option Injection Vulnerability
HIGHCVE-2026-26194 is a HIGH release tag option injection vulnerability (CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')) affecting Gogs libraries in the Go ecosystem. The issue involves release tag option injection in release deletion. Remediation is available by upgrading affected packages to version 0.14.2.
CVE-2026-26194 at a Glance
How to Fix CVE-2026-26194
To remediate this vulnerability, upgrade all affected Gogs dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
Upgrade gogs.io/gogs to 0.14.2Run the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for gogs.io/gogsHow to Check if You Are Affected
To determine whether your application is affected by CVE-2026-26194, inspect your project dependencies for Gogs:
inspect dependencies for gogs.io/gogsAnalyze the terminal output to locate any version of Gogs in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 0.14.2), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection'), where the product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string. In Gogs, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2026-26194 Affected Gogs Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
gogs.io/gogs
|
Go |
< 0.14.2
|
0.14.2
|
References
Frequently Asked Questions
What is CVE-2026-26194?
Which Gogs versions are affected?
What version fixes CVE-2026-26194?
Is gogs.io/gogs affected?
What CWE is associated with CVE-2026-26194?
How can I check Go dependencies for CVE-2026-26194?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-v9vm-r24h-6rqm",
"modified" : "2026-03-05T22:28:40Z",
"published" : "2026-03-05T19:29:44Z",
"aliases" : [ "CVE-2026-26194" ],
"summary" : "Gogs: Release tag option injection in release deletion",
"details" : "### Summary\n\nThere is a security issue in Gogs where deleting a release can fail if a user-controlled tag name is passed to Git without the right separator, allowing Git option injection and therefore interfering with the process.\n\n### Affected Component\n\n - internal/database/release.go\n `process.ExecDir(..., \"git\", \"tag\", \"-d\", rel.TagName)`\n\n### Details\n\n `rel.TagName` is used as a CLI argument to `git tag -d` without `--` or `--end-of-options`.\n If the tag name begins with `-`, Git parses it as a flag.\n\n The prior mitigation is incomplete. There is path sanitization in place during creation:\n\n - internal/database/release.go\n `r.TagName = strings.TrimLeft(r.TagName, \"-\")`\n\n But it only covers one creation path and does not reliably protect tag deletions, such as tags added through `git push` or ref updates.\n\n**Exploit Conditions**\n1. An attacker can add a tag name that starts with a dash into the repository.\n2. A user with permission to delete releases triggers it through the web UI or API.\n\n### Recommended Fix\n\n1. Add end-of-options in release deletion:\n - `git tag -d -- <tagName>`\n2. It is better to use the safe git-module deletion helper since it handles options properly.\n3. All Git commands should be audited for user input, ensuring that the end-of-options separator is always used.\n\n### Impact\n - Option injection into `git tag -d`\n - Tag/release deletion can fail or behave unexpectedly\n - Operational denial of service in release cleanup workflows\n - Potential release metadata inconsistency",
"severity" : [ {
"type" : "CVSS_V4",
"score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Go",
"name" : "gogs.io/gogs"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "0.14.2"
} ]
} ],
"database_specific" : {
"last_known_affected_version_range" : "<= 0.14.1"
}
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/gogs/gogs/security/advisories/GHSA-v9vm-r24h-6rqm"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-26194"
}, {
"type" : "WEB",
"url" : "https://github.com/gogs/gogs/pull/8175"
}, {
"type" : "WEB",
"url" : "https://github.com/gogs/gogs/commit/a000f0c7a632ada40e6829abdeea525db4c0fc2d"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/gogs/gogs"
}, {
"type" : "WEB",
"url" : "https://github.com/gogs/gogs/releases/tag/v0.14.2"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-88" ],
"severity" : "HIGH",
"github_reviewed" : true,
"github_reviewed_at" : "2026-03-05T19:29:44Z",
"nvd_published_at" : "2026-03-05T19:16:03Z"
}
}