CVE-2026-52806 Gogs: RCE via git rebase --exec argument injection in pull request merge
Authenticated attackers can achieve remote code execution on Gogs servers by injecting arguments into git rebase commands via crafted pull request branch names.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-52806?
CVE-2026-52806 is a critical command injection vulnerability in gogs, published on 24 Jun 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Gogs is an open source self-hosted Git service. Prior to 0.14.3, Gogs allows authenticated users to achieve Remote Code Execution (RCE) on the server by creating a pull request with a specially crafted branch name that injects the --exec flag into the git rebase command during the "Rebase before merging" merge operation. This vulnerability is fixed in 0.14.3.
Weakness: CWE-77
Which versions are affected by CVE-2026-52806?
3 open source packages ship an affected version, including gogs.io/gogs.
| Package | Affected | Fixed in |
|---|---|---|
gogs.io/gogs Go | All versions | None |
gogs.io/gogs Go | All versions | 0.14.3 |
gogs.io/gogs Go | All versions | 0.14.3 |
How do I fix CVE-2026-52806?
Upgrade gogs.io/gogs to 0.14.3 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-52806 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-52806 exists.
Public exploit code: 1 Metasploit module, 1 Nuclei template and 1 proofs of concept on GitHub.
Sources
Also known as GHSA-qf6p-p7ww-cwr9, GO-2026-5580.