{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-118389", "assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2", "state": "PUBLISHED", "assignerShortName": "Gitea", "dateReserved": "2026-11-15T20:29:37.637Z", "datePublished": "2026-11-15T21:13:39.832Z", "dateUpdated": "2026-11-15T21:13:39.832Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2", "shortName": "Gitea", "dateUpdated": "2026-11-15T21:13:39.832Z"}, "title": "Gitea RubyGems compact index injection through package metadata", "descriptions": [{"lang": "en", "value": "The RubyGems package registry accepted gems whose platform, dependency names or dependency version requirements contain newline characters. Because the compact index served to clients is line-based, a user who can publish a gem to an owner's registry could forge index entries, such as packages that do not exist or additional versions of an existing gem with dependencies of their choice. Clients that resolve gems from that registry could then be led to install attacker-chosen dependencies. Gems with such metadata are now rejected."}], "affected": [{"vendor": "Gitea", "product": "Gitea", "packageName": "gitea.dev", "defaultStatus": "unaffected", "versions": [{"version": "0", "status": "affected", "lessThan": "28.3.0", "versionType": "semver"}]}], "references": [{"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-49c9-hm8q-6rvq", "name": "GitHub Security Advisory GHSA-49c9-hm8q-6rvq", "tags": ["vendor-advisory"]}, {"url": "https://github.com/go-gitea/gitea/pull/39782", "name": "Fix: go-gitea/gitea pull request #39782", "tags": ["patch"]}, {"url": "https://github.com/go-gitea/gitea/pull/39900", "name": "Fix backport to release/v28: go-gitea/gitea pull request #39900", "tags": ["patch"]}, {"url": "https://blog.gitea.com/release-of-28.4.0/", "name": "Gitea 28.4.0 release announcement", "tags": ["release-notes"]}, {"url": "https://github.com/go-gitea/gitea/releases/tag/v28.3.0", "name": "go-gitea/gitea v28.3.0 release", "tags": ["release-notes"]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-74", "description": "CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')"}]}], "credits": [{"lang": "en", "value": "https://github.com/nithissh7", "type": "reporter"}, {"lang": "en", "value": "https://github.com/hariprasanth9317-tech", "type": "reporter"}, {"lang": "en", "value": "https://github.com/basavaraj-sm05", "type": "remediation developer"}]}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageName": "gitea.dev", "product": "Gitea", "vendor": "Gitea", "versions": [{"lessThan": "28.3.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "88ee5874-cf24-4952-aea0-31affedb7ff2"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The RubyGems package registry accepted gems whose platform, dependency names or dependency version requirements contain newline characters. Because the compact index served to clients is line-based, a user who can publish a gem to an owner's registry could forge index entries, such as packages that do not exist or additional versions of an existing gem with dependencies of their choice. Clients that resolve gems from that registry could then be led to install attacker-chosen dependencies. Gems with such metadata are now rejected."}], "id": "CVE-2026-118389", "lastModified": "2026-11-15T22:17:17.460", "metrics": {}, "published": "2026-11-15T22:17:17.350", "references": [{"source": "88ee5874-cf24-4952-aea0-31affedb7ff2", "url": "https://blog.gitea.com/release-of-28.4.0/"}, {"source": "88ee5874-cf24-4952-aea0-31affedb7ff2", "url": "https://github.com/go-gitea/gitea/pull/39782"}, {"source": "88ee5874-cf24-4952-aea0-31affedb7ff2", "url": "https://github.com/go-gitea/gitea/pull/39900"}, {"source": "88ee5874-cf24-4952-aea0-31affedb7ff2", "url": "https://github.com/go-gitea/gitea/releases/tag/v28.3.0"}, {"source": "88ee5874-cf24-4952-aea0-31affedb7ff2", "url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-49c9-hm8q-6rvq"}], "sourceIdentifier": "88ee5874-cf24-4952-aea0-31affedb7ff2", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-74"}], "source": "88ee5874-cf24-4952-aea0-31affedb7ff2", "type": "Secondary"}]}

{}

{"created": "2026-11-15T22:30:05.523011+00:00", "updated": "2026-11-15T22:30:05.523013+00:00", "vendors": []}