ID:12965 - Exploit for Command injection in gogs - CVE-2026-52806

Link to public exploit:

Vulnerability description

The vulnerability allows a remote user to execute arbitrary code on the server.

The vulnerability exists due to command injection in the pull request merge rebase operation when processing a specially crafted pull request base branch name during a rebase-before-merging action. A remote user can create a pull request with a branch name that injects the --exec option into git rebase to execute arbitrary code on the server.

Exploitation requires the rebase-before-merging option to be enabled for the repository.

Remediation