Rapid7 Labs disclosed a critical unpatched argument injection vulnerability (CVSSv4 9.4) in Gogs, the self-hosted Git service. Any authenticated user can achieve RCE on the server by creating a pull request with a branch name like `--exec=<payload>`, which gets passed unsanitized to `git rebase` during the 'Rebase before merging' merge operation. On default-configured instances, open registration means an unauthenticated attacker can register an account and exploit this immediately. The impact includes full server compromise, cross-tenant data breach, credential theft, lateral movement, and supply chain attacks. Gogs 0.14.2 and 0.15.0+dev are confirmed vulnerable. Despite responsible disclosure starting March 17, 2026, the maintainer has not released a patch. A Metasploit module is available. Mitigations include disabling open registration and restricting repository creation.
