Base64 Decode with IFS Variable (Gogs RCE)

Ethan Andrews@eandrews

•updated May 28, 2026•5•0•12

Detects processes utilizing ${IFS} in conjunction with Base64 decoding. This technique is used by the Gogs argument injection exploit to bypass Git branch name space restrictions while delivering encoded shell payloads.