Affected by GO-2025-4258
and 4 other vulnerabilities
GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea
GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea
GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea
GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea
GO-2026-4274: Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists in code.gitea.io/gitea
CmdArg represents a command argument for git command, and it will be used for the git command directly without any further processing.
In most cases, you should use the "AddXxx" functions to add arguments, but not use this type directly.
Casting a risky (user-provided) string to CmdArg would cause security issues if it's injected with a "--xxx" argument.
Affected by 
Documentation
¶
Source Files