Authenticated RCE Vulnerability in Gogs via Argument Injection (Unpatched as of May 2026) (rapid7.com)

• Critical argument injection (CVSSv4 9.4) in Gogs up to version 0.14.2 and 0.15.0+dev
• Attacker needs only an authenticated account; no admin privileges required
• No patch available; Metasploit module released; mitigations: restrict registration and repo creation

"Rapid7 disclosed a critical argument injection vulnerability (CVSSv4 9.4) in Gogs, a popular self-hosted Git service. Any authenticated user can achieve remote code execution on the server by creating a pull request with a malicious branch name that injects the `--exec` flag into `git rebase` during merge. No patch is available. Affected are all versions supporting rebase merging. Mitigations include restricting user registration and repository creation."