Critical Gogs RCE Vulnerability Lets Any Authenticated User Execute Arbitrary Code
A critical remote code execution (RCE) vulnerability has been identified in Gogs, a popular self-hosted Git service, allowing authenticated users to execute arbitrary code. The flaw, detailed by Jonah Burgess, stems from a malicious pull request with a crafted branch name during the rebase merging process. This vulnerability poses a significant risk, potentially leading to server breaches, data theft, and code manipulation.
The vulnerability, reported to the maintainer on March 17, 2026, is rated 9.4 on the CVSS scoring system and allows an attacker to gain remote code execution (RCE) on a Gogs server. The attack vector involves creating a pull request with a specific branch name that injects the `--exec` flag into the `git rebase` command during the 'Rebase before merging' merge operation. This leverages the functionality of `git rebase` to execute shell commands after each commit. The vulnerability doesn't require admin privileges or interaction with other users, making it relatively easy to exploit.