New Gogs 0-Day Lets Attackers Execute Code Remotely on Servers

A critical zero-day vulnerability has been discovered in Gogs, the widely used open-source self-hosted Git service, allowing any authenticated user to achieve remote code execution (RCE) on the underlying server.

Rapid7 researcher Jonah Burgess discovered the flaw, which carries a CVSSv4 score of 9.4 (Critical) and remains unpatched at the time of disclosure.

Tracked as an argument injection flaw (CWE-88), the vulnerability resides in Gogs’ “Rebase before merging” merge operation.

Gogs 0-Day Vulnerability

An attacker can craft a pull request with a malicious branch name containing the --exec flag, which gets injected directly into the underlying git rebase command executed by the server.

Since git rebase accepts an --exec flag that runs arbitrary shell commands via sh -c after each replayed commit, the malicious branch name triggers code execution as the Gogs server process user, Rapid7 said.

The root cause lies in the Merge() function in internal/database/pull.go, which passes the pull request’s base branch name directly to git rebase without a -- separator a POSIX convention that prevents subsequent arguments from being interpreted as flags.

Unlike other call sites in Gogs that were hardened through the safe git-module API, this code path uses raw process.ExecDir, bypassing all existing protections entirely.

What makes this vulnerability particularly dangerous is its extremely low barrier to exploitation. No admin privileges are required, and no interaction with other users is needed; an attacker operates entirely within their own account.

Since Gogs ships with open registration enabled by default (DISABLE_REGISTRATION = false) and no repository creation limits (MAX_CREATION_LIMIT = -1), an unauthenticated attacker can simply register an account, create a repository, enable rebase merging, and execute the full exploit chain independently.

A Metasploit module has been published to automate the entire attack against both Linux and Windows targets, completing the exploit in seconds. On Linux, the payload leverages ${IFS} to bypass Git’s prohibition on spaces in branch names.

The exploit is confirmed to affect Gogs 0.14.2 and 0.15.0+dev (commit b53d3162) across all supported platforms, Linux, macOS, and Windows, regardless of installation method (binary, Docker, or source).

Successful exploitation grants an attacker arbitrary command execution as the Gogs server process user, with severe downstream consequences:

• Server compromise: Full control of the host server
• Cross-tenant data breach: Read access to every repository on the instance, including private repos
• Credential theft: Dump of password hashes, API tokens, SSH keys, and 2FA secrets for all users
• Lateral movement: Pivoting to other systems reachable from the server’s network
• Supply chain attacks: Modification of any hosted repository’s code, with changes difficult to detect without commit signing

A Shodan search for internet-facing Gogs instances returns over 1,141 exposed deployments, though the real-world install base, including private VPN and internal network deployments at companies, universities, and open-source projects, is significantly larger.

Defenders should monitor Gogs server logs for error entries matching:

[E] ...merge: git checkout '--exec=<...>': exit status 128 - error: unknown option `exec=<...>'

Additional artifacts include malicious branch names beginning with -- in repository listings, corrupted repository git states returning HTTP 500 errors, and unexpected API tokens named msf_<hex> persisting in user application settings after exploitation.

Mitigation

Rapid7 reported the vulnerability to the Gogs maintainers on March 17, 2026, but despite multiple follow-ups, no fix has been delivered as of the May 28, 2026, disclosure date. Organizations using Gogs should immediately:

• Set DISABLE_REGISTRATION = true in app.ini to block untrusted account creation
• Set MAX_CREATION_LIMIT = 0 to prevent unauthorized repository creation
• Audit all repositories for branch names beginning with -- and review user API token lists for unexpected entries

This vulnerability follows a pattern of repeated argument injection issues in Gogs, including CVE-2024-39933, CVE-2024-39932, and CVE-2024-39930, all of which were patched in other code paths while the Merge() function remained exposed.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.