Storia in 6 fonti

Lack of response to critical vulnerability in Gogs is a reminder of the limits of open source projects

Two months after Rapid7 discovered the hole in the Git service, the project maintainer has yet to patch the bug.

Raccontata da

Confronto fonti

6 prospettive sulla stessa storia

AI · summaries

infoworld.comStai leggendo1 mesi fa

Lack of response to critical vulnerability in Gogs is a reminder of the limits of open source projects

Two months after Rapid7 discovered the hole in the Git service, the project maintainer has yet to patch the bug.

originale

theregister.com1 mesi fa

No fix yet for critical RCE bug in open-source Git service Gogs - exploit module is out

Gogs has an unpatched CVSS 9.4 RCE exploitable by any authenticated user on default installs, 10 weeks after Rapid7's responsible disclosure with no maintainer response. A public Metasploit module makes exploitation imminent — disable open registration and rebase merging immediately or migrate to Gitea.

Leggi questa versione → originale

bleepingcomputer.com1 mesi fa

New Gogs zero-day flaw lets hackers get remote code execution

An unpatched zero-day vulnerability in the Gogs self-hosted Git service can allow attackers to gain remote code execution (RCE) on Internet-facing instances.

Leggi questa versione → originale

securityweek.com1 mesi fa

Gogs Zero-Day Exposes Servers to Remote Code Execution

Open source Git service Gogs is affected by a critical-severity zero-day vulnerability that exposes servers to remote code execution.

Leggi questa versione → originale

thehackernews.com1 mesi fa

Critical Gogs RCE Vulnerability Lets Any Authenticated User Execute Arbitrary Code

Gogs 9.4 CVSS flaw exploits git rebase injection on 1,141 exposed instances, enabling remote code execution.

Leggi questa versione → originale

heise.de1 mesi fa

Warten auf Sicherheitspatch: Self-hosted-Git-Service Gogs ist verwundbar

Angreifer können Gogs-Server in den Standardeinstellungen mit Schadcode attackieren. Bislang können Admins Systeme nur über einen Workaround schützen.

Leggi questa versione → originale

Timeline cronologica

giovedì 28 maggio 2026·infoworld.com
Lack of response to critical vulnerability in Gogs is a reminder of the limits of open source projects
Two months after Rapid7 discovered the hole in the Git service, the project maintainer has yet to patch the bug.
giovedì 28 maggio 2026·bleepingcomputer.com
New Gogs zero-day flaw lets hackers get remote code execution
An unpatched zero-day vulnerability in the Gogs self-hosted Git service can allow attackers to gain remote code execution (RCE) on Internet-facing instances.
giovedì 28 maggio 2026·thehackernews.com
Critical Gogs RCE Vulnerability Lets Any Authenticated User Execute Arbitrary Code
Gogs 9.4 CVSS flaw exploits git rebase injection on 1,141 exposed instances, enabling remote code execution.
venerdì 29 maggio 2026·heise.de
Warten auf Sicherheitspatch: Self-hosted-Git-Service Gogs ist verwundbar
Angreifer können Gogs-Server in den Standardeinstellungen mit Schadcode attackieren. Bislang können Admins Systeme nur über einen Workaround schützen.
venerdì 29 maggio 2026·securityweek.com
Gogs Zero-Day Exposes Servers to Remote Code Execution
Open source Git service Gogs is affected by a critical-severity zero-day vulnerability that exposes servers to remote code execution.
venerdì 29 maggio 2026·theregister.com
No fix yet for critical RCE bug in open-source Git service Gogs - exploit module is out
Researcher reported the vuln in March. Maintainers haven't responded to his messages since