The Gogs zero-day vulnerability is a critical argument injection flaw (CVSS 9.4) that allows remote code execution via malicious branch names in pull requests. It exploits the 'Rebase before merging' merge operation, which passes the base branch name to the git rebase command without sanitization, allowing injection of the '--exec' flag to run arbitrary shell commands. Attackers with authenticated access can exploit this without user interaction, as Gogs enables open registration and repository creation by default. The flaw enables attackers to execute commands as the Gogs server process user, compromising server integrity, accessing private repositories, credentials, and potentially pivoting within the network. The vulnerability impacts default-configured Gogs servers on multiple operating systems. No official patch has been released yet, though the maintainers were notified in mid-March 2026. Rapid7 has published an exploit module and IoCs to aid detection.

Successful exploitation results in arbitrary command execution with the privileges of the Gogs server process user. This can lead to full server compromise, unauthorized access to all repositories including private ones, credential theft (password hashes, API tokens, SSH keys, 2FA secrets), and lateral movement within the network. The vulnerability affects default-configured Gogs instances across Windows, Linux, and macOS. Since open registration and repository creation are enabled by default, unauthenticated attackers can create accounts and repositories to exploit the flaw if 'Rebase before merging' is enabled. The lack of a patch means the vulnerability remains exploitable on affected systems.

As of the latest information, no official patch or fix has been released by the Gogs maintainers. Organizations should disable the 'Rebase before merging' feature if enabled, as it is not enabled by default and is required for exploitation. Restrict repository creation and user registration to trusted users to reduce the attack surface. Monitor for indicators of compromise provided by Rapid7 and consider applying any available workarounds or mitigations recommended by security advisories. Check the Gogs official channels regularly for updates or patches addressing this vulnerability.