CISA has added CVE‑2026‑60004 to its Known Exploited Vulnerabilities (KEV) catalogue. The flaw affects Gitea, the self‑hosted Git service, and is named the Gitea Code Injection Vulnerability. It allows an attacker who already has write access to a repository to submit a malicious patch through the diffpatch API, which plants an executable Git hook and enables execution of arbitrary shell commands under the Gitea service account.
The vulnerability is a code injection issue exploitable via the diffpatch API endpoint. An authenticated user with repository write permissions can craft a patch that, when processed, writes a malicious hook script to the repository’s hooks directory. When the hook is triggered, the attacker can run commands with the privileges of the Gitea service account, potentially leading to full compromise of the host. The CVSS score for CVE‑2026‑60004 is 0.0, indicating that the vulnerability is currently unrated in the NVD; no patch has been made publicly available.
Because the entry appears in the KEV catalogue, CISA confirms that the vulnerability is being actively exploited in the wild. No known ransomware campaign has been linked to this CVE at this time. Federal agencies must apply mitigations by the remediation deadline of 28 August 2026.
CISA requires that Federal Civilian Executive Branch (FCEB) agencies apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26‑04 Prioritizing Security Updates Based on Risk guidance and CISA’s “Forensics Triage Requirements”. Agencies should follow the applicable BOD 26‑04 guidance for cloud services or discontinue use of Gitea if mitigations are unavailable. Each stakeholder must evaluate the asset’s internet exposure and adhere to the BOD 26‑04 patching guidelines. All other organisations are advised to review their exposure to Gitea and implement any available mitigations promptly.
For full details, consult the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-60004 and the CISA KEV catalogue.