Git Rebase Exec Argument Injection

Ethan Andrews@eandrews

•updated May 28, 2026•3•0•9

Detects git rebase commands containing the `--exec=` flag, which is indicative of the argument injection vulnerability used to achieve RCE in Gogs. This rule specifically looks for the execution of 'git' or 'git.exe' with 'rebase' and '--exec=' in the command line.