Actively exploited — patch now
Gitea Code Injection Vulnerability
Critical Gitea flaw lets authenticated users run code as the service account. Patch to 1.27.1 now.
What it affects
Gitea, all versions prior to 1.27.1. The flaw is in the diffpatch API endpoint.
What's wrong
A code injection vulnerability (CWE-94) allows an attacker with repository write access to submit a crafted patch that plants an executable Git hook. This hook runs shell commands as the Gitea service account. The vulnerability is reachable over the network with no authentication and no user interaction, and has a CVSS base score of 9.8 (CRITICAL).
Are you affected?
Yes, if you run Gitea before 1.27.1. This is listed in CISA KEV and confirmed exploited in the wild. EPSS is 85%, meaning active exploitation is highly likely.
How to fix it
Upgrade to Gitea 1.27.1 or later.
If you cannot patch yet
Restrict network access to the Gitea service and audit repository write permissions. Monitor for suspicious Git hooks and unexpected shell activity under the Gitea service account.
Fixed versions
From the OSV database, per distribution. Upgrade to at least the version shown.
| Distribution | Package | Fixed in |
|---|---|---|
| Upstream release | Gitea | 1.27.1 |