Executive brief
Gogs allows argument injection during the tagging of a new release in github.com/gogs/gogs
Affected products
- Go github.com/gogs/gogs
- Go gogs.io/gogs
Junglewise Threat Intelligence
CVE-2024-39933: GO-2024-2972 - Gogs allows argument injection during the tagging of a new release in github.com/gogs/gogs
CVE-2024-39933 · Severity: low · CVSS 3.1 · Published 2024-07-09
Technologies: github.com/gogs/gogs (Go), gogs.io/gogs (Go). Vendors: Go.
Related threats
- GO-2026-5193 - Gogs: XSS in .ipynb files renderer due to outdated notebookjs in gogs.io/gogs
- Gogs stored XSS in Jupyter Notebook sanitizer endpoint
- Gogs unauthenticated information disclosure in organization teams API
- Gogs Denial of Service via SSH handshake stall in built-in SSH server
- Gogs path traversal and RCE via organization names