{"api_version":"1","generated_at":"2026-11-15T23:52:24+00:00","cve":"CVE-2026-118389","urls":{"html":"https://cve.report/CVE-2026-118389","api":"https://cve.report/api/cve/CVE-2026-118389.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-118389","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-118389"},"summary":{"title":"Gitea RubyGems compact index injection through package metadata","description":"The RubyGems package registry accepted gems whose platform, dependency names or dependency version requirements contain newline characters. Because the compact index served to clients is line-based, a user who can publish a gem to an owner's registry could forge index entries, such as packages that do not exist or additional versions of an existing gem with dependencies of their choice. Clients that resolve gems from that registry could then be led to install attacker-chosen dependencies. Gems with such metadata are now rejected.","state":"PUBLISHED","assigner":"Gitea","published_at":"2026-11-15 22:17:17","updated_at":"2026-11-15 22:17:17"},"problem_types":["CWE-74","CWE-74 CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')"],"metrics":[],"references":[{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-49c9-hm8q-6rvq","name":"https://github.com/go-gitea/gitea/security/advisories/GHSA-49c9-hm8q-6rvq","refsource":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/go-gitea/gitea/pull/39900","name":"https://github.com/go-gitea/gitea/pull/39900","refsource":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/go-gitea/gitea/pull/39782","name":"https://github.com/go-gitea/gitea/pull/39782","refsource":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.3.0","name":"https://github.com/go-gitea/gitea/releases/tag/v28.3.0","refsource":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://blog.gitea.com/release-of-28.4.0/","name":"https://blog.gitea.com/release-of-28.4.0/","refsource":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-118389","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118389","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Gitea","product":"Gitea","version":"affected 28.3.0 semver","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"https://github.com/nithissh7","lang":"en"},{"source":"CNA","value":"https://github.com/hariprasanth9317-tech","lang":"en"},{"source":"CNA","value":"https://github.com/basavaraj-sm05","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","packageName":"gitea.dev","product":"Gitea","vendor":"Gitea","versions":[{"lessThan":"28.3.0","status":"affected","version":"0","versionType":"semver"}]}],"credits":[{"lang":"en","type":"reporter","value":"https://github.com/nithissh7"},{"lang":"en","type":"reporter","value":"https://github.com/hariprasanth9317-tech"},{"lang":"en","type":"remediation developer","value":"https://github.com/basavaraj-sm05"}],"descriptions":[{"lang":"en","value":"The RubyGems package registry accepted gems whose platform, dependency names or dependency version requirements contain newline characters. Because the compact index served to clients is line-based, a user who can publish a gem to an owner's registry could forge index entries, such as packages that do not exist or additional versions of an existing gem with dependencies of their choice. Clients that resolve gems from that registry could then be led to install attacker-chosen dependencies. Gems with such metadata are now rejected."}],"problemTypes":[{"descriptions":[{"cweId":"CWE-74","description":"CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-15T21:13:39.832Z","orgId":"88ee5874-cf24-4952-aea0-31affedb7ff2","shortName":"Gitea"},"references":[{"name":"GitHub Security Advisory GHSA-49c9-hm8q-6rvq","tags":["vendor-advisory"],"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-49c9-hm8q-6rvq"},{"name":"Fix: go-gitea/gitea pull request #39782","tags":["patch"],"url":"https://github.com/go-gitea/gitea/pull/39782"},{"name":"Fix backport to release/v28: go-gitea/gitea pull request #39900","tags":["patch"],"url":"https://github.com/go-gitea/gitea/pull/39900"},{"name":"Gitea 28.4.0 release announcement","tags":["release-notes"],"url":"https://blog.gitea.com/release-of-28.4.0/"},{"name":"go-gitea/gitea v28.3.0 release","tags":["release-notes"],"url":"https://github.com/go-gitea/gitea/releases/tag/v28.3.0"}],"title":"Gitea RubyGems compact index injection through package metadata"}},"cveMetadata":{"assignerOrgId":"88ee5874-cf24-4952-aea0-31affedb7ff2","assignerShortName":"Gitea","cveId":"CVE-2026-118389","datePublished":"2026-11-15T21:13:39.832Z","dateReserved":"2026-11-15T20:29:37.637Z","dateUpdated":"2026-11-15T21:13:39.832Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-11-15 22:17:17","lastModifiedDate":"2026-11-15 22:17:17","problem_types":["CWE-74","CWE-74 CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')"],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"118389","Ordinal":"1","Title":"Gitea RubyGems compact index injection through package metadata","CVE":"CVE-2026-118389","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"118389","Ordinal":"1","NoteData":"The RubyGems package registry accepted gems whose platform, dependency names or dependency version requirements contain newline characters. Because the compact index served to clients is line-based, a user who can publish a gem to an owner's registry could forge index entries, such as packages that do not exist or additional versions of an existing gem with dependencies of their choice. Clients that resolve gems from that registry could then be led to install attacker-chosen dependencies. Gems with such metadata are now rejected.","Type":"Description","Title":"Gitea RubyGems compact index injection through package metadata"}]}}}