The critical Gogs RCE vulnerability is a serious reminder that self-hosted Git platforms are not just internal developer conveniences. They are part of the software supply-chain control plane. The flaw carries a CVSS 9.4 rating and allows any authenticated user to achieve remote code execution by creating a pull request with a malicious branch name that injects the --exec flag into git rebase during the “Rebase before merging” operation.

This is especially dangerous because the attacker does not need administrator privileges. Any authenticated user with the ability to create a pull request may be able to execute code on the underlying Gogs server. For organizations using Gogs to host source code, automation scripts, credentials, deployment logic, or internal projects, server compromise can quickly become a wider supply-chain and infrastructure risk. 

The issue is also concerning because the vulnerability is reportedly unpatched at the time of disclosure, with Rapid7 advising users to disable the “Rebase before merging” feature as a mitigation. There are also more than 1,100 internet-exposed Gogs instances, which means attackers have a ready-made scan surface while everyone else debates whether “internal Git” is actually critical. Spoiler: it is. 

Organizations using Gogs should immediately restrict external access, disable “Rebase before merging,” limit pull-request creation to trusted users, review logs for suspicious branch names or merge activity, and monitor the host for unexpected processes or command execution. Where possible, Gogs should be isolated, placed behind VPN or zero-trust access controls, and treated as sensitive development infrastructure. 

The broader lesson is simple: source-code platforms need the same protection as production systems. If attackers compromise the platform that stores code and drives collaboration, they may gain access to intellectual property, secrets, build workflows, and deployment paths. A Git server is not “just a repo.” It is often the blueprint, workshop, and launchpad for everything that follows.

A critical security vulnerability has been disclosed in Gogs, a popular open-source self-hosted Git service, that allows an authenticated user to execute arbitrary code under certain conditions. The security flaw, per Rapid7, is rated 9.4 on the CVSS scoring system. It does not have a CVE identifier. "The vulnerability allows any authenticated user to achieve remote code execution (RCE) on

Source: Critical Gogs RCE Vulnerability Lets Any Authenticated User Execute Arbitrary Code via The Hacker News — published 28 May 2026.