Unpatched Zero-Day in Gogs Git Service Exposes Global Servers to Remote Code Execution

LONDON (May 28, 2026) — A critical, unpatched security vulnerability in the Gogs self-hosted Git service is allowing attackers to execute remote code on Internet-facing instances worldwide. The flaw, identified by Rapid7 senior security researcher Jonah Burgess, affects the Merge() code path and has not been addressed by the project's maintainers despite being reported weeks ago.

The vulnerability, classified as a zero-day, stems from an argument injection flaw that permits unauthorized command execution. Burgess reported the issue to the Gogs maintainers on March 17, but no patch has been released as of May 28. The exposure leaves thousands of servers vulnerable to compromise, with the highest concentration of affected instances located in Asia and Europe.

Gogs is an open-source, lightweight Git service designed for self-hosting. Unlike commercial platforms, it is often deployed on public-facing servers by organizations and developers seeking control over their version control infrastructure. The unpatched nature of the vulnerability means any exposed instance remains susceptible to exploitation until a fix is implemented and deployed.

Security researchers warn that the flaw allows attackers to take full control of affected systems. Once exploited, malicious actors could access sensitive code repositories, steal intellectual property, or use the compromised servers as a foothold for further attacks within a network. The risk is heightened because many users may not be aware their instances are exposed to the public internet.

Burgess disclosed the vulnerability publicly after the maintainers failed to issue a patch within a reasonable timeframe. The disclosure includes technical details that could enable exploitation, raising concerns among security professionals about the immediate threat to exposed systems. Administrators of Gogs instances are urged to take immediate defensive measures, including isolating affected servers from the internet or applying temporary workarounds if available.

The Gogs development team has not issued a public statement regarding the vulnerability or a timeline for a fix. The lack of response has drawn criticism from the security community, which emphasizes the importance of timely patching to protect users. Without a vendor-supplied solution, users must rely on manual mitigation strategies that may not fully eliminate the risk.

As of May 28, no confirmed attacks exploiting this vulnerability have been reported. However, the public disclosure of the flaw increases the likelihood of malicious actors targeting exposed instances. Security experts recommend that organizations audit their Git infrastructure and consider migrating to alternative platforms with active security support.

The situation remains fluid as administrators scramble to secure their systems. Questions remain about the extent of the exposure and whether any instances have already been compromised. Until a patch is released and widely deployed, the vulnerability poses a significant risk to the integrity of self-hosted Git services globally.