Git Rebase --exec Argument Injection (Gogs/Gitea RCE)

Tim Peck@timpeck

•updated May 28, 2026•2•0•10

Detects `git rebase` commands containing the `--exec=` flag when spawned by a Gogs or Gitea server process. This activity is indicative of the exploitation of an argument injection vulnerability (CVE-2022-46153) in Gogs/Gitea, which allows an authenticated user to achieve Remote Code Execution (RCE) by creating a pull request with a specially crafted branch name. The rule specifically looks for `git` or `git.exe` processes executing `rebase` with `--exec=` and originating from `gogs`, `gitea`, or common shell processes that might be spawned by them.