Gogs is an open source self-hosted Git service. Prior to version 0.14.2, there's a security issue in gogs where deleting a release can fail if a user controlled tag name is passed to git without the right separator, this lets git options get injected and mess with the process. This issue has been patched in version 0.14.2.
Denotes Vulnerable Software Are we missing a CPE here? Please let us know .
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
