Overview

Rapid7 Labs senior security researcher Jonah Burgess (CryptoCat) disclosed an unpatched argument injection vulnerability in Gogs, a Go-based self-hosted Git service with roughly 50,000 GitHub stars and over 5,000 forks. The vulnerability — tracked as GHSA-qf6p-p7ww-cwr9 and rated CVSSv4 9.4 (Critical) — allows any authenticated user to achieve remote code execution (RCE) by submitting a pull request with a malicious base branch name that injects the --exec flag into the underlying git rebase invocation. The latest release at the time of research, Gogs 0.14.2, and the development tip 0.15.0+dev (commit b53d3162) are both confirmed vulnerable; all prior versions supporting the 'Rebase before merging' merge style are likely affected. At the time of public disclosure (May 28, 2026) no vendor patch exists, despite responsible disclosure on March 17, 2026 and multiple follow-ups through May 2026.

Root cause

The Merge() function in internal/database/pull.go executes the rebase merge style by directly invoking git rebase via process.ExecDir (a thin wrapper over exec.Command), passing the pull request's base branch as a positional argument WITHOUT the POSIX `--` end-of-options separator:

process.ExecDir(-1, tmpBasePath, fmt.Sprintf("PullRequest.Merge (git rebase): %s", tmpBasePath), "git", "rebase", "--quiet", pr.BaseBranch, remoteHeadBranch)

pr.BaseBranch is taken from the user-controlled URL parameter in internal/route/repo/pull.go (parsed from the `*` catch-all via strings.Split(c.Params("*"), "...")). Both base and head refs are validated through RevParse (which calls git rev-parse --verify <ref>) before the PR is created; RevParse rejects refs that do not resolve to a valid Git object but does NOT sanitize against argument injection. Because the attacker first pushes a real branch with the malicious name, RevParse succeeds, the value is persisted, and is later passed verbatim to git rebase. Git's argument parser then interprets the leading `--exec=...` token as the --exec flag rather than a branch name, and git rebase executes the supplied value through `sh -c` after each replayed commit.

Exploit primitive

Git branch names may legally contain `$`, `{`, `}`, `=`, and `-`. The attacker creates a branch named e.g.:

--exec=touch${IFS}/tmp/rce_proof

When used as pr.BaseBranch the resulting command becomes:

git rebase --quiet '--exec=touch${IFS}/tmp/rce_proof' 'head_repo/feature'

`${IFS}` is expanded by the shell to a space at sh -c execution time, sidestepping Git's prohibition on literal spaces in branch names. For payloads requiring characters illegal in Git refs (`:`, `~`, `^`, `?`, `*`, `[`, `\`, `//`), the attacker base64-encodes the command and decodes inline:

--exec=echo${IFS}<b64>|base64${IFS}-d|sh

On Windows, the `|` character is forbidden in NTFS filenames (Git stores refs as files under refs/heads/), so the public Metasploit module switches to file-based delivery: the attacker commits a small script (e.g. `.abcdef`) and `.abcdef.bat` to the repository and uses the short branch name `--exec=sh${IFS}.abcdef`. To bypass MSYS2 sh's mangling of `$`, `&`, and backticks in the payload, the script invokes `cmd.exe //c .abcdef.bat` so the PowerShell payload runs natively without shell metacharacter interpretation.

Execution flow during Merge()

The MergeStyleRebase code path runs these git commands sequentially in a temp directory: 1. git clone -b '<malicious>' <repo> <tmp> -> succeeds; `-b` consumes --exec=... as the branch value 2. git remote add head_repo <repo> && git fetch head_repo -> succeeds 3. git rebase --quiet '<malicious>' 'head_repo/feature' -> RCE fires here; --exec=<cmd> parsed as flag, command runs via sh -c 4. git checkout -b <tmpBranch> -> succeeds (server-generated timestamp branch) 5. git checkout '<malicious>' -> fails: git interprets --exec=... as an invalid option for checkout

Step 5 fails and Merge() returns HTTP 500, which is logged but does not undo the RCE that fired at step 3. The aborted merge leaves the target repository in a partial-rebase state, which limits each existing-repo target to a single firing of the exploit.

Mergeability race

For the merge button to be reachable, the PR must reach PullRequestStatusMergeable. Gogs's testPatch() calls UpdateLocalCopyBranch(pr.BaseBranch). On a fresh repository with no local copy, that function takes the Clone path which includes `--end-of-options`, so the malicious ref is treated as data and the patch test completes cleanly — promoting the PR to Mergeable. On subsequent re-tests by the background TestPullRequests goroutine, the local copy already exists so UpdateLocalCopyBranch takes the Checkout path, which is MISSING `--end-of-options`; the checkout fails and checkAndUpdateStatus() is skipped, leaving the PR stuck Mergeable forever. The PoC reliably hits the Clone path by always operating against a freshly created repository.

Why default configurations are trivially exploitable

Gogs ships with DISABLE_REGISTRATION=false (open registration) and MAX_CREATION_LIMIT=-1 (unlimited repository creation). Any registered user who creates a repo is automatically its owner and can toggle 'Rebase before merging' (PullsAllowRebase) in Settings > Advanced. The complete exploit chain — register, create repo, enable rebase merging, push malicious branch, open PR, click merge — is operable entirely within the attacker's own account with no interaction from other users. On instances with restricted registration or repo creation, exploitation still requires only write access to any repository that already has (or can have) rebase merging enabled.

Impact

The Gogs process user (commonly `git`, UID 1000 in the official Docker image) has direct filesystem read/write access to every repository on the instance under a single REPOSITORY_ROOT directory with no OS-level isolation between tenants. Successful exploitation yields: arbitrary command execution as the Gogs service user; cross-tenant data breach (read every private repository on the instance); credential theft from the Gogs database including password hashes, API tokens, SSH public keys, and 2FA secrets; lateral movement to other systems reachable from the server's network; and supply-chain attack capability via direct filesystem manipulation of any hosted repository (which bypasses Gogs's audit logging and is difficult to detect absent commit signing).

Relationship to prior argument-injection fixes

Gogs has patched related argument-injection issues across multiple advisories — CVE-2024-39933 (git tag), CVE-2024-39932 (git diff), CVE-2026-26194 (release tag deletion), and CVE-2024-39930 (built-in SSH server git upload-pack/receive-pack). The underlying git-module library was hardened with `--end-of-options` across Clone(), Push(), Fetch(), and 28 other call sites in v1.8.7. However, Merge() in internal/database/pull.go was never migrated to the safe git-module API and still uses raw process.ExecDir, leaving the git rebase code path unprotected.

Exploitation status and tooling

A fully weaponized Metasploit module accompanies the Rapid7 disclosure, supporting two operating modes: `own_repo` (default — creates a temporary repository under the attacker's account, exploits, and deletes the repo to minimize artifacts) and `existing_repo` (targets a repository the attacker already has write access to; only command payloads, since the partial-rebase corruption prevents multi-stage payload delivery). The module works against Linux and Windows targets and obtains a Meterpreter session in seconds. Because the public exploit is automated and no patch exists, mass exploitation of internet-facing Gogs instances is the expected near-term trajectory.

Remediation

No vendor patch is available. Administrators should restrict user registration (DISABLE_REGISTRATION=true in app.ini), restrict repository creation (MAX_CREATION_LIMIT=0), audit which repositories have 'Rebase before merging' enabled (Settings > Advanced > PullsAllowRebase), monitor server logs for ERROR entries matching `merge: git checkout '--exec=...'`, audit repository branch listings for refs beginning with `--`, and audit API tokens for names matching `msf_<hex>` (the Metasploit module's token-creation pattern, which persists after exploitation because Gogs exposes no token-deletion API endpoint).