CVE-2026-52806: Gogs: RCE via git rebase --exec argument injection in pull request merge

Synopsis

Argument injection leading to remote code execution affects Gogs, the self-hosted Git service, in versions before 0.14.3. The vulnerability is reachable over the network by any authenticated user with low privileges, and no interaction from another user or administrator is needed to trigger it. Successful exploitation gives an attacker full control over the server process, including the ability to read, modify, or delete any data the server can access. HarborGuard tracks this advisory and will make a patched-image rebuild available as soon as an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Gogs HTTP or SSH interface over the network to submit a pull request with the malicious branch name.

• AuthenticationRequired

  Any low-privilege account with repository access is sufficient; no administrator credentials are needed.

• Victim interactionNot required

  The attacker triggers the vulnerability by initiating the rebase-merge operation themselves; no other user needs to take any action.

• Attack complexityDetail

  Exploitation is reliable and condition-free: crafting a branch name that injects the --exec flag requires no race conditions or special environmental state.

Blast Radius

• The attacker executes arbitrary commands as the Gogs server process, giving full control over the host environment accessible to that process.
• All repository data hosted on the instance, including source code, commit history, and secrets stored in repository settings, is readable and modifiable.
• The attacker can write or overwrite files on the server filesystem, enabling persistence mechanisms such as backdoored hooks or credential theft.
• The Gogs service and any co-located services sharing the same host or container can be disrupted or terminated.