CISA Warns of Critical Gitea Code Injection Vulnerability, CVE-2024-0123

Key Takeaways

• A critical code injection flaw in Gitea, CVE-2026-60004, is actively being exploited in the wild.
• The vulnerability allows attackers with repository write access to execute arbitrary shell commands on the server.
• Gitea instances, particularly self-hosted and cloud deployments, are at risk.
• CISA has added this vulnerability to its KEV catalog, mandating a rapid remediation deadline for federal agencies.
• Immediate patching and security audits are crucial for all Gitea users.

Gitea Code Injection Flaw Under Active Exploitation

The Cybersecurity and Infrastructure Security Agency (CISA) has issued a stark warning regarding a newly identified and actively exploited vulnerability within Gitea, a popular self-hosted Git service. The flaw, designated as CVE-2026-60004, has been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog, confirming its active exploitation by threat actors.

Gitea serves as a crucial platform for developers and enterprises managing source code repositories, making any compromise a significant threat to software supply chains. This particular security issue is categorized as a code injection vulnerability, mapped to CWE-94, which signifies improper control over code generation.

Technical Details of the Vulnerability

According to CISA’s assessment, the vulnerability permits an attacker with existing write access to a Gitea repository to exploit the system. This is achieved by sending a specially crafted malicious patch to the diffpatch API endpoint. This tailored patch can then plant an executable Git hook directly onto the server.

Once deployed, this malicious hook grants the attacker the ability to execute arbitrary shell commands. These commands run with the same privileges as the Gitea service account, potentially leading to significant system compromise. A critical aspect of this attack path is its low barrier to entry: it does not necessitate administrative credentials, only write permissions to a repository, a common level of access for many collaborators and contributors in development teams.

The planted malicious hook executes automatically during standard Git operations, providing attackers with a stealthy and persistent method to escalate control over the underlying server infrastructure.

CISA’s Mandate and Remediation Deadline

CISA officially added CVE-2026-60004 to its KEV catalog on August 25, 2026. Federal agencies and other affected organizations have been given a tight remediation deadline of August 28, 2026, underscoring the urgency of addressing this critical flaw. While CISA has not yet confirmed whether this vulnerability has been leveraged in ransomware campaigns, its status in that regard is currently listed as unknown. The agency has also clarified that forensic triage under Binding Operational Directive 26-04 is not presently required for this specific vulnerability.

CISA is directing all agencies and stakeholders to implement mitigations in accordance with vendor instructions and to ensure compliance with BOD 26-04, which mandates the prioritization of security updates based on risk levels. Organizations utilizing cloud-hosted Gitea instances must adhere to the relevant BOD 26-04 guidance for cloud services or, if no suitable mitigation is available, discontinue product use entirely.

The agency stresses that stakeholders bear the responsibility for evaluating each affected asset’s internet exposure and for ensuring timely patching in strict adherence to directive guidelines. Given that self-hosted Git platforms like Gitea are fundamental infrastructure for software development, they represent high-value targets for threat actors aiming to inject malicious code into software supply chains.

What You Should Do

• Apply Patches Immediately: Monitor Gitea’s official channels for vendor-issued security patches and apply them without delay.
• Audit Repository Access: Conduct a thorough audit of all repository write access controls within your Gitea instances. Ensure that only trusted individuals and services have the necessary permissions.
• Review Git Hooks: Examine existing Git hooks on your Gitea server for any suspicious or unauthorized entries.
• Monitor for Anomalous Activity: Implement robust logging and monitoring for Gitea server activity, paying close attention to API calls to the diffpatch endpoint and any unusual shell command executions.
• Isolate and Segment: Where possible, isolate Gitea instances within your network to minimize potential lateral movement in case of a compromise.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.