Unpatched Gogs Argument Injection Flaw Enables Authenticated RCE

Rapid7 and BleepingComputer reported an unpatched zero-day in the self-hosted Git service Gogs that allows authenticated remote code execution through argument injection in the pull request rebase workflow. The flaw affects current releases including 0.14.2 and 0.15.0+dev, and likely earlier versions that support rebase merging. An attacker can abuse the "Rebase before merging" feature by supplying a malicious branch name that is passed into a git rebase command without a proper option separator, enabling use of Git's --exec flag to run attacker-controlled shell commands as the Gogs server process user.

The issue is rated CVSSv4 9.4 and is considered especially dangerous on default-configured instances because open registration and unrestricted repository creation are enabled by default, lowering the barrier to exploitation. Successful attacks could expose private repositories, stored credentials, and secrets, enable code tampering and supply-chain compromise, and support lateral movement deeper into victim networks. Rapid7 said no vendor patch was available at publication time and released a Metasploit module for Linux and Windows, while separate reporting noted Gogs maintainers had only acknowledged the report. The disclosures follow broader scrutiny of Git hosting platforms, including a recently disclosed Gitea flaw, CVE-2026-27771, that can expose private container images without authentication on versions prior to 1.26.2.