Lack of response to critical vulnerability in Gogs is a reminder of the limits of open source projects

No fix yet for critical RCE bug in open-source Git service Gogs - exploit module is out

Gogs has an unpatched CVSS 9.4 RCE exploitable by any authenticated user on default installs, 10 weeks after Rapid7's responsible disclosure with no maintainer response. A public Metasploit module makes exploitation imminent — disable open registration and rebase merging immediately or migrate to Gitea.