Reported by 1 outlet

Timeline

1. original reporting

   Gogs Zero-Day (CVSS 9.4) — Unpatched Argument Injection Enables Authenticated RCE — Metasploit Module Published, No Fix Available

   rapid7.com · 138d ago · May 29th, 2026

   A critical argument injection vulnerability (CWE-88) in Gogs, the popular self-hosted Git service, allows any authenticated user to achieve remote code execution on the underlying server. Discovered by Rapid7's Jonah Burgess and tracked without a CVE ID, the flaw resides in Gogs' "Rebase before merging" merge operation: the Merge() function passes the pull request's base branch name directly to git rebase without a -- separator, allowing an attacker to inject the --exec flag and execute arbitrary shell commands via sh -c.

   Why this is dangerous: Gogs ships with open registration enabled by default (DISABLE_REGISTRATION = false) and no repository creation limits (MAX_CREATION_LIMIT = -1) — an unauthenticated attacker can register an account, create a repo, enable rebase merging, and exploit the flaw without any interaction from other users. A Metasploit module automates the full chain in seconds against both Linux and Windows targets. Shodan reveals 1,141+ internet-facing instances, with the true install base (including VPN/internal deployments at companies and universities) significantly larger.

   Impact: Full server compromise, cross-tenant data breach (read every repository including private ones), credential database dump (password hashes, API tokens, SSH keys, 2FA secrets), lateral movement, and supply-chain attacks via repository code modification. Rapid7 reported the flaw to Gogs maintainers on March 17, 2026 — no patch has been released. Mitigations: Set DISABLE_REGISTRATION = true, set MAX_CREATION_LIMIT = 0, audit for branch names beginning with --, and review user API token lists. A Shodan search http.title:"Gogs" http.title:"Sign In" will find exposed instances.

   ---