An AI pentesting agent from Aikido Security discovered a path traversal vulnerability in Gogs (CVE-2026-52813) via unsanitized organization usernames, which was escalated to full remote code execution by abusing Git hooks in nested bare repositories. Two additional bugs were reported: a push authorization bypass on read-only repos (CVE-2026-52810, still unpatched) and a stored XSS in Jupyter notebook rendering via an outdated notebookjs library. The RCE and XSS issues were fixed in Gogs 0.14.3, though Gogs is described as no longer actively maintained, and a switch to another self-hosted git solution is recommended in the meantime.
Table of contents
Path traversal in organization namePush authorization bypass using receive-pack confusionStored XSS in .ipynb filesDetectionConclusionQuestions this post answers
What is CVE-2026-52813 in Gogs and how does it lead to remote code execution?
CVE-2026-52813 is a path traversal vulnerability in Gogs' organization username field, which lacks the sanitization applied to regular usernames, allowing an attacker to create organizations with names like ../../../../../tmp/test. By nesting a bare repository inside another repository's worktree path, an attacker can edit the bare repo's hooks/update file via a native git push and trigger arbitrary command execution as the git user. It affects Gogs versions 0.14.2 and below and is fixed in 0.14.3. daily.dev surfaces security writeups like this so self-hosted git admins can patch before attackers do.
Is the Gogs push authorization bypass CVE-2026-52810 patched yet?
No, CVE-2026-52810, a logic bug allowing writes on read-only repositories, has no officially fixed version and all Gogs versions remain vulnerable to it. It was reported alongside a path traversal RCE and a stored XSS bug, both of which were fixed in Gogs 0.14.3, but this particular bypass is still open. Track unresolved vulnerabilities like this on daily.dev before deciding whether to keep running Gogs.
How does the stored XSS in Gogs Jupyter notebook rendering work despite server-side sanitization?
The XSS bypasses bluemonday sanitization because the vulnerable notebookjs library (version 0.4.2, versus the latest 0.8.0) assigns raw HTML to an element's innerHTML before sanitization occurs, triggering event handlers like onerror on an img tag even though the element is never added to the DOM. A crafted .ipynb file with an onerror payload in a markdown cell executes JavaScript when viewed. Developers evaluating git hosting security tradeoffs can follow findings like this on daily.dev.