🔴 Critical | Source: The Hacker News
A critical remote code execution vulnerability in Gitea (CVE-2026-60004, CVSS 9.8) allows any user with standard repository write access to inject malicious content via a patch that creates a Git hook, enabling arbitrary shell commands to run as the Gitea service account. The flaw affects all Gitea versions from 1.17 up to but not including 1.27.1, which contains the fix. Because write access is commonly granted to developers and contributors, the attack surface is broad and the barrier to exploitation is low.
Security Architect’s Take: Upgrade all Gitea instances to 1.27.1 immediately; if patching cannot happen at once, restrict repository write access to the minimum required set of trusted users and consider isolating the Gitea service account with no shell access or meaningful filesystem permissions to limit blast radius.
Original advisory: New Gitea RCE Lets Repository Writers Plant a Git Hook to Run Shell Commands