Critical Gogs Vulnerability CVE-2024-XXXXX Allows Remote Code Execution

Key Takeaways

• A critical zero-day vulnerability (CVE-2024-XXXXX) has been discovered in Gogs, a popular self-hosted Git platform.
• The flaw allows any authenticated user to execute arbitrary code on the server, even without administrative privileges.
• The vulnerability, rated CVSSv4 9.4 (Critical), impacts Gogs 0.14.2, 0.15.0+dev, and potentially all prior versions supporting rebase merges.
• No official patch is currently available from the vendor, necessitating immediate mitigation strategies for affected deployments.

A severe zero-day vulnerability has been identified in Gogs, a widely adopted self-hosted Git service, enabling remote code execution for any authenticated user. This critical flaw, tracked as CVE-2024-XXXXX, poses a significant risk to organizations utilizing the platform, particularly given the absence of an immediate vendor patch.

The vulnerability was uncovered by Rapid7 Labs researcher Jonah Burgess, known as “CryptoCat,” and is categorized as a CWE-88 argument injection issue. It has been assigned a CVSSv4 score of 9.4, indicating its critical severity.

The vulnerability resides within the “Rebase before merging” functionality of Gogs and affects the latest stable release, Gogs 0.14.2, as well as the development build 0.15.0+dev (commit b53d3162). Furthermore, all earlier versions that support the rebase merge operation are also likely susceptible to this exploit.

Understanding the Gogs Zero-Day

The exploit specifically targets the Merge() function, located in internal/database/pull.go. This function is designed to pass pull request base branch names directly to a git rebase command. Critically, it does so without implementing a POSIX -- separator or adequate argument sanitization, creating an injection point.

Attackers can craft a malicious branch name, such as --exec=touch${IFS}/tmp/rce_proof. When a pull request using this specially crafted branch is initiated, and the rebase merge operation is subsequently triggered, Git’s argument parser misinterprets --exec as a command-line flag instead of a branch name. This misinterpretation causes Git to execute the attacker-controlled command via sh -c after each replayed commit.

The successful execution of this attack results in arbitrary command execution under the privileges of the Gogs server process user. Typically, this user is ‘git’ on both Docker and binary installations, granting significant control over the underlying system.

A key factor amplifying the danger of this vulnerability is its low barrier to exploitation. Gogs installations often come with open user registration and unlimited repository creation enabled by default. As Jonah Burgess explained, an unauthenticated attacker can simply register an account, create a new repository, enable rebase merging within their settings, and then launch the entire exploit chain. This process requires no interaction from other users or any administrative privileges, making it highly accessible to malicious actors.

Consequences of Exploitation

The potential ramifications of a successful exploit are extensive and severe:

• Full Server Compromise: Attackers can achieve arbitrary command execution as the Gogs process user, potentially leading to a complete takeover of the server.
• Cross-Tenant Data Breach: The vulnerability allows for reading all repositories on the instance, including private repositories belonging to other users.
• Credential Theft: Attackers can dump sensitive information such as password hashes, API tokens, SSH keys, and 2FA secrets from the Gogs database.
• Lateral Movement: The compromised server can be used as a pivot point to access other systems reachable from its network.
• Supply Chain Attacks: Malicious actors could silently modify code within any hosted repository, bypassing audit logging and introducing backdoors into software supply chains.

Gogs boasts a substantial user base, with approximately 50,000 GitHub stars and over 5,000 forks. A Shodan search conducted at the time of publication revealed 1,141 internet-facing instances, though the actual installed base is likely much larger due to internal and VPN-protected deployments.

The threat is further compounded by the public release of a fully functional Metasploit module, which makes exploitation trivial and automatable within seconds.

Defenders should actively monitor Gogs server logs for ERROR-level entries that contain patterns such as git checkout '--exec=<...>': exit status 128. Additionally, administrators are advised to audit repository branch listings for any names commencing with --. It is also crucial to inspect user token lists at /-/user/settings/applications for unexpected entries like msf_<hex> and to review pull request histories on sensitive repositories for suspicious activity.

What You Should Do

As of the time of reporting, no vendor patch has been released for CVE-2024-XXXXX. Organizations must implement immediate mitigation measures to protect their Gogs instances:

• Disable User Registration: Set DISABLE_REGISTRATION = true in your app.ini configuration file to prevent new, untrusted accounts from being created.
• Limit Repository Creation: Configure MAX_CREATION_LIMIT = 0 to restrict users from creating new repositories, thereby limiting potential attack vectors.
• Audit “Rebase before merging” Settings: Thoroughly review all repositories for the “Rebase before merging” setting, paying particular attention to repositories that involve external collaborators. Consider disabling this feature where possible until a patch is available.

Rapid7 initially reported this vulnerability to Gogs maintainers on March 17, 2026. Despite multiple follow-up communications through May 2026, a fix has not yet been delivered.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.