A new 0-day vulnerability in Gogs, a popular self-hosted Git service, allows authenticated users to run arbitrary commands on the server and potentially take full control of the system.
The flaw was discovered by Rapid7 Labs and is rated Critical with a CVSS v4 score of 9.4. At the time of publication, there is no official patch from the Gogs maintainers, which means thousands of internet-facing and internal Gogs instances may currently be exposed to this risk.
New Gogs 0-Day Flaw
The issue lies in how Gogs handles the “Rebase before merging” option for pull requests. When this feature is enabled, Gogs runs a Git rebase command under the hood to replay commits from one branch onto another.
However, the application passes the base branch name directly into the Git command without using a safe argument separator. Because Git supports an “–exec” flag that instructs it to run a shell command after each commit, an attacker can create a malicious branch whose name contains this flag and their chosen payload.
During the merge operation, Git interprets the injected “–exec” argument as a valid option, allowing remote code execution as the Gogs server process user.
What makes this vulnerability particularly dangerous is that it does not require admin rights or any interaction from other users. By default, Gogs allows open registration and does not limit repository creation.
This means an attacker can sign up, create a repository, enable the “Rebase before merging” setting, craft a malicious branch name, and open a pull request.
The exploit chain runs entirely within the attacker’s own account and repository. Even on hardened deployments where registration or repository creation is restricted, any user with write access to a repository that has rebase merging enabled can still exploit the flaw.
Once exploited, the consequences are serious. The attacker gains the ability to run arbitrary commands as the Gogs process user, which is typically a “git” or dedicated service account.
From there, they can read all repositories hosted on the server, including private code, configuration files, and internal tools. They can dump the database to steal password hashes, API tokens, SSH private keys, and two-factor authentication secrets.
With this level of access, they can also pivot to other systems on the same network and carry out supply-chain attacks by silently modifying source code.
Because Gogs stores repositories together on disk under a single root directory, and direct filesystem changes can bypass application logging, malicious changes may be difficult to detect without strong code integrity controls such as commit signing and rigorous review.
Rapid7 confirmed the vulnerability on Gogs 0.14.2 and 0.15.0+dev and believes all versions that support the “Rebase before merging” style are likely impacted.
The bug exists because the merge logic uses a low-level process-execution wrapper instead of the hardened git-module API, which was previously updated to add “–end-of-options” or “–” separators across many Git operations. As a result, the rebase call remained unprotected, leaving a new argument injection path despite earlier security fixes in other areas of the codebase.
Attackers already have an easy path to automation. Rapid7 has released a Metasploit module that performs the full exploit flow against both Linux and Windows Gogs servers.
In many cases, the only obvious sign of exploitation is an HTTP 500 error during the merge process and a corresponding error entry in the server logs complaining about an unknown “–exec” option.
If the target is an existing shared repository, defenders may also see a suspicious branch named “–exec”, a failed pull request, and a repository stuck in a corrupted Git state.
Since no patch is available yet, administrators should treat this as an actively exploitable 0-day and apply strong mitigations. Recommended steps include disabling public user registration, restricting who can create repositories, auditing repositories and logs for suspicious branch names and errors, and limiting write and merge permissions to only highly trusted users.
Where possible, place Gogs instances behind VPNs or access gateways, and closely monitor for any abnormal behavior until the Gogs maintainers release an official fix.
Indicators of compromise (IoCs)
[E] ...merge: git checkout '--exec=<...>': exit status 128 - error: unknown option `exec=<...>'Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
