Gogs Zero-Day Exposes Servers to Remote Code Execution

A critical zero-day in Gogs (CVSS 9.4) allows authenticated users to execute arbitrary code via malicious branch names in pull requests. The vulnerability exploits argument injection in the rebase merge operation. Any organization running self-hosted Gogs is at risk, and public exploits are already available.

CRITICALAdvisoryMay 31, 2026

Action required

Immediately identify all Gogs instances in your environment. Disable the 'Rebase before merging' feature until patched, restrict pull request creation to trusted users only, and monitor for suspicious git rebase processes and branch creation activity.

Affected products

GogsRapid7

Linked articles

Gogs Zero-Day Exposes Servers to Remote Code Execution

Source links

https://www.securityweek.com/gogs-zero-day-exposes-servers-to-remote-code-execution/