No fix yet for critical RCE bug in open-source Git service Gogs - exploit module is out
A critical Gogs flaw lets authenticated users run code on default installs. No patch is out yet, and a public Metasploit module already exists.
Intelligence analysis by GPT-5.4 Mini
Gogs has a critical argument-injection bug in pull request merging. On default installs, an authenticated user can use it to run code, steal secrets, or alter repository contents, while maintainers still have not released a fix.
A Git website called Gogs has a bad mistake in how it handles one kind of code merge. If a bad person gets an account, they may trick it into running their own secret commands.
It is like a mailbox that should only accept letters, but instead it also opens any random package as if it were a tool. That can let someone mess with the house from the inside.
The scary part is that no fix is out yet, and a ready-made break-in tool is already public. People who run Gogs should lock down signups and turn off the risky merge setting for now.
Analysis
What happened
Rapid7 researcher Jonah Burgess reported a 9.4-rated Gogs vulnerability in mid-March, but the project still has no official patch. According to the report, the flaw affects supported Windows, Linux, and macOS installations and can be triggered by any authenticated user on a default setup.
How the bug works
The problem sits in Gogs’ pull request merge flow, specifically the Merge() function in internal/database/pull.go. If a repository owner or admin enables Rebase before merging, the pull request’s base branch name is passed straight into a git rebase command without a -- separator and without proper sanitizing. That lets an attacker supply a malicious branch name that Git interprets as a command option instead of a normal branch reference.
Burgess says an example payload can cause Git to run attacker-controlled commands. He also built a cross-platform exploit module, including a different delivery method for Windows. The existence of a public Metasploit module means exploitation may follow quickly, even though Burgess told The Register he has no evidence of in-the-wild attacks yet.
What users can do now
Until Gogs ships a fix, Burgess recommends tightening access: disable user registration, limit repository creation, and turn off Rebase before merging. He also warns that these controls are not enough against a malicious repo owner or admin, because they can re-enable rebase themselves. There is no global or organization-level setting to block that behavior.
Key points
- A critical Gogs RCE flaw affects default installations and requires only an authenticated account.
- The bug is tied to the pull request merge flow when “Rebase before merging” is enabled.
- A public Metasploit module now exists, raising the chance of near-term exploitation.
- Rapid7 says it has not seen evidence of in-the-wild abuse yet.
- Recommended mitigations include disabling registration, limiting repo creation, and turning off rebase merges.
