CVE-2026-52806: Gogs Remote Code Execution via Git Rebase Argument Injection
Summary
CVE-2026-52806: Gogs vulnerable to RCE via git rebase --exec argument injection in pull request merge. Affects gogs.io/gogs versions < 0.14.3. Fixed in 0.14.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Gogs is an open-source self-hosted Git service that allows users to manage Git repositories, collaborate on projects, and facilitate code reviews through features like pull requests. It is designed for ease of use and is popular among developers and organizations for hosting their code. However, Gogs has a critical vulnerability that allows authenticated users to execute arbitrary code on the server through a flaw in the pull request merging process.
Vulnerability Detail
The vulnerability arises from Gogs allowing authenticated users to inject the '--exec' argument into the 'git rebase' command during the pull request merge operation. This occurs when a user creates a pull request with a specially crafted branch name that includes the '--exec' flag. The flaw is rooted in the way Gogs processes branch names without proper validation, leading to potential remote code execution (RCE) on the server. The ramifications are severe, as an attacker could gain full control over the server, access sensitive data, and compromise other repositories hosted on the same instance.
How To Fix
Latest published version: v0.13.3 as of 22 Oct 2026
go get gogs.io/gogs@v0.13.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.14.3
This is the first release that contains the fix.
go get gogs.io/gogs@v0.14.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the 'Rebase before merging' option in the repository settings to prevent exploitation until the package is updated. This can be done by navigating to the repository settings and unchecking the 'Allow rebase' option.
Conclusion
CVE-2026-52806 is a critical vulnerability in Gogs that allows for remote code execution through improper handling of branch names during pull request merges. Users are strongly advised to update to the latest version to mitigate this risk and ensure the security of their Gogs instances.
See every vulnerability recorded for gogs.io/gogs →
FAQ
CVE-2026-52806 is a critical vulnerability in Gogs that allows authenticated users to execute arbitrary code on the server through a flaw in the pull request merging process.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities. Visit Vulert Scanner to check if your application is affected without requiring any signup.
The vulnerability can lead to server compromise, data breaches, credential theft, and supply chain attacks, allowing attackers to execute arbitrary commands on the server.
Download the latest version of Gogs (0.14.3 or later) from the official repository and follow the installation instructions to update your instance.
If immediate updating is not possible, disable the 'Rebase before merging' option in your repository settings to mitigate the risk until you can apply the patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for gogs.io/gogs.
