https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 14:20:46 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-09386 bdu:2026-09386 https://cve.radiocsirt.org/vuln/bdu:2026-09386 https://cve.radiocsirt.org/vuln/euvd-2026-330462 EUVD-2026-330462 https://cve.radiocsirt.org/vuln/euvd-2026-330462 https://cve.radiocsirt.org/vuln/fkie_cve-2026-52806 <p>Gogs is an open source self-hosted Git service. Prior to 0.14.3, Gogs allows authenticated users to achieve Remote Code Execution (RCE) on the server by creating a pull request with a specially crafted branch name that injects the --exec flag into the git rebase command during the &#34;Rebase before merging&#34; merge operation. This vulnerability is fixed in 0.14.3.</p> <p>Gogs is an open source self-hosted Git service. Prior to 0.14.3, Gogs allows authenticated users to achieve Remote Code Execution (RCE) on the server by creating a pull request with a specially crafted branch name that injects the --exec flag into the git rebase command during the &#34;Rebase before merging&#34; merge operation. This vulnerability is fixed in 0.14.3.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-52806 https://cve.radiocsirt.org/vuln/ghsa-qf6p-p7ww-cwr9 <p><strong>Affected:</strong> Go: gogs.io/gogs</p> <p># Gogs: RCE via `git rebase --exec` Argument Injection in PR Merge</p> <p>## Summary</p> <p>Gogs allows authenticated users to achieve Remote Code Execution (RCE) on the server by creating a pull request with a specially crafted branch name that injects the `--exec` flag into the `git rebase` command during the &#34;Rebase before merging&#34; merge operation.</p> <p>## Severity</p> <p>**Critical** - CVSS 3.1 Base Score: 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)</p> <p>## Affected Versions</p> <p>- **Gogs 0.14.2** (latest supported release) - Gogs 0.15.0+dev (commit `b53d3162`, main branch as of 2026-03-16) - All prior versions that support the &#34;Rebase before merging&#34; merge style</p> <p>## Impact</p> <p>This is a **privilege escalation from authenticated user to server-level code execution**. The attacker uses their own repository as the delivery mechanism - the target is not the repository but the Gogs server itself. On any multi-tenant Gogs instance (company, university, open source hosting), this gives one authenticated user full control of the underlying server:</p> <p>- **Server compromise**: Arbitrary command execution as the Gogs process user - **Cross-tenant data breach**: Read ALL repositories on the instance, including other users&#39; private repos - **Credential theft**: Access the database containing password hashes, API tokens, SSH keys, and 2FA secrets for every user - **Lateral movement**: Pivot to other systems accessible from the server&#39;s network - **Supply chain attacks**: Silently modify any hosted repository&#39;s code. The…</p> <p><strong>Affected:</strong> Go: gogs.io/gogs</p> <p># Gogs: RCE via `git rebase --exec` Argument Injection in PR Merge</p> <p>## Summary</p> <p>Gogs allows authenticated users to achieve Remote Code Execution (RCE) on the server by creating a pull request with a specially crafted branch name that injects the `--exec` flag into the `git rebase` command during the &#34;Rebase before merging&#34; merge operation.</p> <p>## Severity</p> <p>**Critical** - CVSS 3.1 Base Score: 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)</p> <p>## Affected Versions</p> <p>- **Gogs 0.14.2** (latest supported release) - Gogs 0.15.0+dev (commit `b53d3162`, main branch as of 2026-03-16) - All prior versions that support the &#34;Rebase before merging&#34; merge style</p> <p>## Impact</p> <p>This is a **privilege escalation from authenticated user to server-level code execution**. The attacker uses their own repository as the delivery mechanism - the target is not the repository but the Gogs server itself. On any multi-tenant Gogs instance (company, university, open source hosting), this gives one authenticated user full control of the underlying server:</p> <p>- **Server compromise**: Arbitrary command execution as the Gogs process user - **Cross-tenant data breach**: Read ALL repositories on the instance, including other users&#39; private repos - **Credential theft**: Access the database containing password hashes, API tokens, SSH keys, and 2FA secrets for every user - **Lateral movement**: Pivot to other systems accessible from the server&#39;s network - **Supply chain attacks**: Silently modify any hosted repository&#39;s code. The…</p> https://cve.radiocsirt.org/vuln/ghsa-qf6p-p7ww-cwr9 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1739 <p>Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Gogs ausnutzen, um beliebigen Programmcode auszuführen.</p> <p>Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Gogs ausnutzen, um beliebigen Programmcode auszuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1739