Executive Summary
A critical vulnerability (CVSS 9.4) has been identified in the Gogs self-hosted Git service that allows any authenticated user to execute arbitrary commands on the server. The flaw stems from improper sanitization of branch names during the 'rebase before merging' process, where an attacker can inject malicious Git flags like --exec into the underlying system call. At the time of reporting, no official patch is available from the vendor.
The attack is highly accessible because Gogs often enables open registration and unrestricted repository creation by default. An attacker can create their own repository, enable rebase merging, and execute the payload without interacting with any other users. This allows for total server compromise, including the ability to read all private repositories, dump user credentials (hashes, SSH keys, 2FA secrets), and perform lateral movement within the network.
This vulnerability is particularly dangerous for multi-tenant environments such as universities or development teams. Since the Gogs process often runs with direct filesystem access to all repositories, an attacker can also facilitate supply chain attacks by modifying hosted code without leaving standard audit logs. Organizations should immediately consider restricting registration and repository creation until a fix is released.