Vulnerability Description
Gogs is an open source self-hosted Git service. Prior to version 0.14.2, there's a security issue in gogs where deleting a release can fail if a user controlled tag name is passed to git without the right separator, this lets git options get injected and mess with the process. This issue has been patched in version 0.14.2.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Gogs | Gogs | < 0.14.2 |
Related Weaknesses (CWE)
References
- https://github.com/gogs/gogs/commit/a000f0c7a632ada40e6829abdeea525db4c0fc2dPatch
- https://github.com/gogs/gogs/pull/8175Issue Tracking
- https://github.com/gogs/gogs/releases/tag/v0.14.2Release Notes
- https://github.com/gogs/gogs/security/advisories/GHSA-v9vm-r24h-6rqmExploitVendor AdvisoryMitigation
FAQ
What is CVE-2026-26194?
CVE-2026-26194 is a vulnerability with a CVSS score of 7.3 (HIGH). Gogs is an open source self-hosted Git service. Prior to version 0.14.2, there's a security issue in gogs where deleting a release can fail if a user controlled tag name is passed to git without the r...
How severe is CVE-2026-26194?
CVE-2026-26194 has been rated HIGH with a CVSS base score of 7.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-26194?
Check the references section above for vendor advisories and patch information. Affected products include: Gogs Gogs.