Gogs Rebase Injection Remote Code Execution and 0.14.3 Patch Response

A critical argument injection flaw in **Gogs** allowed an authenticated, non-admin user to gain remote code execution through the **Rebase before merging** workflow on exposed servers. Affected releases ran through **0.14.2** and **0.15.0+dev**, and a malicious branch name could inject the `--exec` flag into `git rebase` during merge processing. Default deployments with open registration and unlimited repository creation lowered the barrier to reach the vulnerable path, because an attacker could create an account and repository before triggering it. Successful abuse could run code as the Gogs server process user, expose private repositories, **password hashes**, **API tokens**, **SSH keys**, and **2FA secrets**, and enable unauthorized code changes or movement to other reachable systems. The issue was reported on **March 17**, acknowledged on **March 28**, and public technical details were released on **May 28** while the flaw was still unpatched. Gogs released **version 0.14.3** on **June 7, 2026** to fix the flaw affecting releases up to **0.14.2** and **0.15.0+dev**, shifting response from workaround planning to immediate upgrade. If patching must wait, operators were advised to restrict registration, limit repository creation, and review rebase merge settings to reduce the easiest attack paths. Available material also noted more than **2,400** Internet-facing Gogs servers, concentrated in **Asia** and **Europe**. Available evidence did not confirm in-the-wild exploitation of this specific flaw.