Deleting a release in Gogs prior to version 0.14.2 can fail when a user‑controlled tag name is passed to git without the correct separator. This flaw allows git options to be injected, which can alter the Git command execution flow. The result may enable an attacker to introduce unintended git options, potentially leading to execution of arbitrary commands within the host environment or disruption of the repository management workflow. The weakness is classified as CWE‑88, indicating a lack of proper input sanitization for command execution.

The affected product is Gogs, the open‑source self‑hosted Git server. All installations of Gogs running any version earlier than 0.14.2 are vulnerable.

The CVSS score is 8.8, reflecting a high severity that could allow modification of repository data or execution of arbitrary code. The EPSS score is less than 1%, suggesting that, as of this analysis, the likelihood of exploitation is low. The vulnerability is not listed in the CISA KEV catalog, so no known widespread active exploitation has been reported. The most likely attack vector is a malicious user who can initiate a release deletion operation, potentially with elevated privileges, to inject invalid git options.