CVE Intelligence
Analysis AI-assisted

CVE-2026-52806: Gogs: command injection in pull request rebase leads to RCE

Gogs versions prior to 0.14.3 let authenticated users trigger command injection through a crafted branch name during the rebase-before-merging operation of a pull request, which the record says can lead to remote code execution. The record assigns a critical CVSS 3.1 base score of 9.9 and states the issue is fixed in 0.14.3. The CISA KEV catalog does not list this CVE in the record, and no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

Gogs is an open source, self-hosted Git service. This record describes a command injection flaw (CWE-77) in the "Rebase before merging" operation for pull requests. According to the record, an authenticated user can supply a crafted branch name that reaches the git rebase command as an injected option, which can lead to remote code execution on the server. The record states the issue is fixed in 0.14.3.

Impact

  • The record describes remote code execution on the server by an authenticated user.
  • The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, with a base score of 9.9 (critical), as provided by the GitHub Security Advisories CNA.
  • The scope is marked as changed (S:C), which suggests impact may extend beyond the vulnerable component. The record does not detail this further.

Affected products and versions

  • Product: Gogs.
  • The description states that versions prior to 0.14.3 are affected.
  • The structured affected and fixes fields in the record are empty, so the exact affected range should be confirmed in the GitHub security advisory.
  • The fixed version 0.14.3 is referenced in the release notes.

Exploitation status

The record shows this CVE is not listed in the CISA KEV catalog. No confirmed exploitation appears in the sources consulted for this analysis.

Remediation and mitigation

  • Upgrade Gogs to 0.14.3 or later, as stated in the record.
  • If an upgrade cannot be applied immediately, restrict who can create accounts and open pull requests, and review access to self-hosted instances.
  • Review the fix commit and the related pull request to understand the change.

Detection guidance

  • Review pull request and branch creation activity for unusual branch names, especially names that could be interpreted as command options.
  • Monitor the Gogs host for unexpected child processes started by the Git service account.
  • Check application logs around merge operations for errors or unusual activity.

Limitations of the available information

  • The record does not populate structured affected or fixed version fields.
  • No EPSS score or SSVC data is available in the record.
  • The record does not describe in-the-wild exploitation beyond the sources consulted, so that status is unknown.
  • This analysis does not include technical exploitation details.

Frequently asked questions

Which Gogs versions are fixed for CVE-2026-52806?

The record states the issue is fixed in Gogs 0.14.3. Versions prior to 0.14.3 are described as affected, but the structured affected range is empty, so confirm details in the GitHub security advisory.

Is CVE-2026-52806 being actively exploited?

The record does not list this CVE in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted for this analysis.

What privileges are needed to exploit this issue?

The CVSS vector in the record shows low privileges required (PR:L) and no user interaction (UI:N), meaning an authenticated user is needed.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.