CVE-2026-52806

Name of the Vulnerable Software and Affected Versions Gogs versions prior to 0.14.3

Description Authenticated users can achieve Remote Code Execution (RCE) on the server during the "Rebase before merging" operation. The issue stems from improper argument handling when the software invokes the git rebase command using a pull request's base branch name without a "--" separator. This allows a specially crafted branch name to be parsed as a command flag, such as the --exec flag, leading to arbitrary command execution as the Gogs process user. Successful exploitation can result in full server compromise, exposure of credentials on shared instances, and unauthorized access to cross-tenant repositories.

Recommendations Update to version 0.14.3.