Critical Argument Injection Zero-Day in Gogs Puts Self-Hosted Git Servers at Risk
A CVSS 9.4 flaw lets authenticated attackers execute arbitrary code through maliciously named pull-request branches — no patch is available.
Gogs, the self-hosted Git service written in Go and popular among small teams and enterprises running air-gapped or private source-code infrastructure, carries a zero-day vulnerability that hands authenticated attackers remote code execution.
The flaw scores a 9.4 on the CVSS scale. That is a critical rating by any rubric.
The vulnerability is an argument injection bug. An attacker who already holds a valid account on a Gogs instance can craft a pull request with a malicious branch name. When the server processes that branch name, the injected arguments reach an underlying system call, enabling arbitrary command execution on the host.
The attack surface is narrower than an unauthenticated bug — you need a foothold first. But in practice that bar is low. Gogs instances frequently allow open registration, and initial access brokers routinely sell compromised developer credentials. A threat actor targeting source-code repositories, whether for intellectual property theft or to plant supply-chain implants, would find a valid Gogs account trivially obtainable.
No official CVE record has been publicly assigned at the time of writing, and the Gogs project had not released a patched version. The issue is a zero-day in the strict sense: disclosed before a fix exists.
The risk profile here matters beyond the server itself. Gogs hosts code. An attacker who achieves RCE on a Gogs instance can read every repository on the server, modify commit history, inject malicious code into builds, or pivot into connected CI/CD pipelines. Software supply-chain intrusions — SolarWinds, 3CX, the Codecov breach — have repeatedly demonstrated how developer infrastructure becomes the entry point for downstream compromise at scale.
Administrators running Gogs should restrict registration to known users immediately, audit existing accounts for anomalous access, and monitor pull-request activity for branch names containing shell metacharacters or unusual argument-style strings. Network-level controls that limit which users can reach the Gogs interface will reduce exposure until a patch ships.
No ransomware group or specific threat actor has been publicly attributed to active exploitation at this stage.
