CVE-2026-528069.9CriticalCWE-77
CVE-2026-52806: Gogs: RCE via git rebase --exec argument injection in pull request merge
No fix listed · Affected: gogs · Exploitation: not established
ExploitationNot established
Not in CISA KEV as of catalogue 2026.11.13 (13 Nov)
- In CISA KEV: not seen
- Exploited (reported): not seen
- Scanning observed: not seen
- Proof of concept public: not seen
- Not establishedNothing in the sources we check
7.9%probability of exploitation in the next 30 days
94th percentile
050100
Higher than 94% of scored CVEs
9.9CriticalCVSS 3.1
LowMediumHighCrit.
DescriptionNVD
Gogs is an open source self-hosted Git service. Prior to 0.14.3, Gogs allows authenticated users to achieve Remote Code Execution (RCE) on the server by creating a pull request with a specially crafted branch name that injects the --exec flag into the git rebase command during the "Rebase before merging" merge operation. This vulnerability is fixed in 0.14.3.
On the Atlas
Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.
- Exploitation
- Check available, not yet exploited. A public nuclei template can confirm it on a system you are authorised to test.
- CISA KEV
- Not listed
- Public check
- Gogs <= 0.14.2 - Authenticated RCE via git rebase Argument Injection · nuclei template in projectdiscovery/nuclei-templates
- Vendor
- gogs
- Published
- June 2026
Coverage1 article · 1 outlet
First in our coverage: SecurityOnline, 26 Jun.
- Critical RCE flaw CVE-2026-52813 hits Gogs, patch outSecurityOnline · first in our coverage · mentions it in passing
New articles also arrive in the RSS feed.