New Gogs zero-day flaw lets hackers get remote code execution
Patch Gogs to 0.14.2 or 0.15.0+dev to eliminate RCE.
Apply the latest Gogs release or patch the merge() code; disable open registration if possible.
Summary
An unpatched argument‑injection flaw in Gogs, the self‑hosted Git service, allows authenticated users without admin rights to execute arbitrary code via pull requests that use a malicious branch name to inject the --exec flag into git rebase during the Rebase before merging operation. The vulnerability affects Gogs 0.14.2 and 0.15.0+dev and can be exploited on default‑configured instances where open registration is enabled and repository creation is unlimited. Attackers can read all repositories, dump credentials such as password hashes, API tokens, SSH keys, and 2FA secrets, pivot to other network‑accessible systems, and modify any hosted code. Shadowserver tracks over 2,400 exposed Gogs servers, mostly in Asia and Europe, while Shodan lists just over 1,000 IP addresses with a Gogs fingerprint. The Gogs maintainers acknowledged the report on March 28 but have not yet released a patch, leaving the flaw in the wild. Similar argument‑injection vulnerabilities (CVE‑2024‑39933, CVE‑2024‑39932, CVE‑2026‑26194, CVE‑2024‑39930) have been addressed in recent years, but this one targets a different code path that was never patched. The flaw was discovered by Rapid7 researcher Jonah Burgess and reported on March 17, 2026.
Key changes
- Authenticated users can execute arbitrary code via malicious pull requests with --exec flag
- Vulnerability affects Gogs 0.14.2 and 0.15.0+dev on default‑configured instances
- Open registration and unlimited repository creation enable attackers to create accounts and repos
- Attackers can read all repositories, dump credentials, pivot to other systems, and modify code
- Shadowserver tracks over 2,400 exposed Gogs servers, mainly in Asia and Europe
- Gogs maintainers have not yet released a patch despite acknowledging the report