CVE record
CVE-2024-39933
Gogs through 0.13.0 allows argument injection during the tagging of a new release.
Gogs through 0.13.0 allows argument injection during the tagging of a new release.
CVE evidence
Known exploitation
Not listed in fetched KEV catalog
Absence from the fetched catalog does not establish that exploitation has not occurred.
Severity
high
CVSS 8.2 · CVSS_V4
Affected packages
2
Supported package records returned by OSV. Vendor and product names are not used to infer matches.
OSV package mapping
Affected open-source packages
| Package | Ecosystem | Fixed versions |
|---|---|---|
| github.com/gogs/gogs | go | Not specified |
| gogs.io/gogs | go | 0.13.1 |