Gitea RubyGems compact index injection through package metadata
Summary
| CVE | CVE-2026-118389 |
|---|---|
| State | PUBLISHED |
| Assigner | Gitea |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-11-15 22:17:17 UTC |
| Updated | 2026-11-15 22:17:17 UTC |
| Description | The RubyGems package registry accepted gems whose platform, dependency names or dependency version requirements contain newline characters. Because the compact index served to clients is line-based, a user who can publish a gem to an owner's registry could forge index entries, such as packages that do not exist or additional versions of an existing gem with dependencies of their choice. Clients that resolve gems from that registry could then be led to install attacker-chosen dependencies. Gems with such metadata are now rejected. |
Risk And Classification
Problem Types: CWE-74 | CWE-74 CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| github.com/go-gitea/gitea/security/advisories/GHSA-49c9-hm8q-6rvq | 88ee5874-cf24-4952-aea0-31affedb7ff2 | github.com | |
| github.com/go-gitea/gitea/pull/39900 | 88ee5874-cf24-4952-aea0-31affedb7ff2 | github.com | |
| github.com/go-gitea/gitea/pull/39782 | 88ee5874-cf24-4952-aea0-31affedb7ff2 | github.com | |
| github.com/go-gitea/gitea/releases/tag/v28.3.0 | 88ee5874-cf24-4952-aea0-31affedb7ff2 | github.com | |
| blog.gitea.com/release-of-28.4.0 | 88ee5874-cf24-4952-aea0-31affedb7ff2 | blog.gitea.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: https://github.com/nithissh7 (en)
CNA: https://github.com/hariprasanth9317-tech (en)
CNA: https://github.com/basavaraj-sm05 (en)
There are currently no legacy QID mappings associated with this CVE.