CVE-2014-8681: SQL Injection in github.com/gogits/gogs
Summary
CVE-2014-8681: SQL Injection in github.com/gogits/gogs. Affects github.com/gogits/gogs versions < 0.5.8. Fixed in 0.5.8. How to fix ↓
Also tracked for
- gogs.io/gogs · Go
The same CVE-2014-8681 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package github.com/gogits/gogs is an open-source self-hosted Git service written in Go. It provides a lightweight Git server with a web interface and supports various features like repository management, issue tracking, and user authentication. However, due to improper sanitization of user input, certain methods in the package are vulnerable to SQL injection attacks if used with unsanitized user input.
Vulnerability Detail
The vulnerability (CVE-2014-8681) in github.com/gogits/gogs arises from the lack of proper input sanitization. This allows an attacker to manipulate user input and inject malicious SQL queries into the application's database. As a result, sensitive data can be accessed, modified, or deleted by the attacker. The vulnerable methods include GetIssues, SearchRepositoryByName, and SearchUserByName. It is crucial for developers to sanitize user input before using it in SQL queries to prevent such attacks.
How To Fix
Latest published version: v0.11.91 as of 23 Oct 2026
go get github.com/gogits/gogs@v0.11.91Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.5.8
This is the first release that contains the fix.
go get github.com/gogits/gogs@v0.5.8Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
A possible workaround for this vulnerability is to manually sanitize user input by escaping special characters and removing potentially harmful characters. However, this approach is error-prone and not recommended, as it is difficult to cover all possible attack vectors. It is strongly advised to follow the recommended fix and implement proper input sanitization techniques.
Conclusion
In conclusion, the package github.com/gogits/gogs is vulnerable to SQL injection attacks due to improper input sanitization. Developers should update to version 0.5.8 or later and implement proper input sanitization techniques, such as using parameterized queries or prepared statements, to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/gogits/gogs →
FAQ
SQL injection is a type of security vulnerability where an attacker can manipulate user input to inject malicious SQL queries into an application's database. This allows the attacker to access, modify, or delete data in the database.
SQL injection can lead to unauthorized access to sensitive data, data manipulation or deletion, and even complete compromise of the application and underlying systems. It can also be used to execute arbitrary commands on the database server.
To prevent SQL injection, it is essential to properly sanitize and validate user input before using it in SQL queries. This can be achieved by using parameterized queries or prepared statements, or by using ORM libraries that handle input sanitization automatically.
Yes, a fix is available for this vulnerability. Developers should update to version 0.5.8 or later of github.com/gogits/gogs, which includes the necessary fixes for SQL injection vulnerabilities.
While there is a workaround of manually sanitizing user input, it is not recommended due to its error-prone nature. It is strongly advised to apply the fix by updating to the latest version of github.com/gogits/gogs and implementing proper input sanitization techniques.
