Critical Gogs flaw lets authenticated users run code

A critical security vulnerability in the popular open-source, self-hosted Git service Gogs allows any authenticated user to execute arbitrary code on the server, posing a severe risk to organizations using the software. The flaw, which carries a maximum severity CVSS score of 9.4, remains unpatched as of late May 2026, despite being reported to the project's maintainers in mid-March.

The vulnerability is an argument injection flaw in the software's merge functionality. Specifically, it allows an attacker to inject the exec flag into the git rebase command during a "Rebase before merging" operation by creating a pull request with a maliciously crafted branch name. This results in remote code execution with the privileges of the Gogs server process, which typically has extensive access to all repositories and sensitive data on the instance.

Exploitation requires no administrative privileges or interaction with other users. An attacker operates entirely within their own account. Since Gogs installations typically have open user registration enabled by default, an unauthenticated attacker can simply create an account and a repository. Any user who creates a repository is...