Critical Vulnerability in Gitea Allows Remote Code Execution via Malicious Hooks

A critical security flaw discovered in the self-hosted Git platform Gitea allows attackers to execute arbitrary shell commands on servers hosting the software. The vulnerability, identified by security researcher Shai Rod of NightRang3r, enables any user with write access to a repository to plant malicious git hooks that run code as the service account running the application.

The issue was disclosed on July 29, 2026. In self-hosted environments, Gitea is widely used by organizations and developers for version control without relying on cloud-based providers. The flaw stems from insufficient sanitization of git hooks within repositories. When a user with write permissions pushes code containing these malicious scripts to the server, the platform executes them automatically during standard Git operations.

Because the commands run as the service account, an attacker could potentially gain full control over the underlying operating system where Gitea is installed. This level of access allows for data exfiltration, modification or deletion of other repositories hosted on the same instance, and lateral movement within a corporate network if the server has connectivity to internal systems.

The Gitea development team confirmed the severity of the issue immediately upon notification from Rod. The vulnerability poses an immediate risk to all self-hosted instances that have not yet applied patches or implemented strict access controls limiting write permissions on sensitive repositories. While cloud-based Git services often employ additional isolation layers, self-hosted deployments rely heavily on the integrity of the software itself and the configuration of user roles.

Rod's research highlighted that the attack vector requires no authentication beyond standard repository write privileges, making it accessible to internal collaborators or compromised accounts with elevated permissions. The mechanism bypasses typical code review processes if an attacker can push directly to a branch without requiring a merge request approval workflow.

The Gitea team has released emergency updates addressing the flaw across multiple versions of the software. Administrators are urged to upgrade their installations immediately and audit existing repositories for any unauthorized hooks that may have been deployed prior to patching. The update includes stricter validation logic for git hook files, ensuring they cannot execute arbitrary system commands.

Despite the rapid response from developers, questions remain regarding the extent of potential exploitation in the wild before the vulnerability was publicly disclosed. There is currently no evidence suggesting active campaigns targeting Gitea instances using this specific method, though security experts warn that zero-day vulnerabilities are often tested by threat actors prior to public disclosure. The lack of information regarding why or how the flaw existed for its duration leaves open questions about whether it has already been leveraged in targeted attacks against organizations relying on self-hosted version control systems.