Critical Gitea Code Injection Vulnerability CVE-2026-60004 Actively Exploited
- Severity
- HIGH
- Affected component
- gitea (github-actions)
- Affected versions
- >= v1.27.0, <= v1.27.0 or >= v1.27.0-rc0, <= v1.27.0-rc0 or >= v1.28.0-dev, <= v1.28.0-dev or >= v1.27.0-dev, <= v1.27.0-dev or >= v1.26.0-dev, <= v1.26.0-dev or >= v1.25.0-dev, <= v1.25.0-dev or >= v1.24.0-dev, <= v1.24.0-dev or >= v1.22.0-rc1, <= v1.22.0-rc1 or >= v1.23.0-dev, <= v1.23.0-dev or >= v1.22.0-rc0, <= v1.22.0-rc0 or >= v1.21.0-rc0, <= v1.21.0-rc0 or >= v1.22.0-dev, <= v1.22.0-dev or >= v1.20.0-rc0, <= v1.20.0-rc0 or >= v1.21.0-dev, <= v1.21.0-dev or >= v1.20.0-dev, <= v1.20.0-dev or >= v1.19.0-rc0, <= v1.19.0-rc0 or >= v1.18.0-rc0, <= v1.18.0-rc0 or >= v1.19.0-dev, <= v1.19.0-dev or >= v1.18.0-dev, <= v1.18.0-dev or >= v1.17.0-dev, <= v1.17.0-dev
- Patched version
- Not yet available
Gitea, a self-hosted Git service, has a critical code injection vulnerability (CVE-2026-60004) that allows authenticated users with repository write access to execute arbitrary shell commands. This flaw is being actively exploited in the wild.
What happened
The vulnerability, tracked as CVE-2026-60004, permits an attacker to submit a malicious patch via the diffpatch API endpoint, enabling the execution of shell commands as the Gitea service account. This can lead to unauthorized access and potential compromise of the affected system. The issue was discovered by security researcher Shai Rod and affects all versions of Gitea from 1.17 onward.
Gitea's default configuration allows self-registration, which means unauthenticated attackers can create an account, establish a repository, and exploit the vulnerability without needing prior credentials. Over 8,300 Internet-exposed Gitea instances remain unpatched and vulnerable to these attacks, according to cybersecurity watchdog Shadowserver.
What to do about it
- Upgrade to the latest version of Gitea to mitigate the risk of exploitation.
- Review and tighten repository access controls to prevent unauthorized access.
- Monitor your Gitea instances for any suspicious activity or unauthorized changes.
- Consider disabling self-registration if it is not required for your use case to reduce the attack surface.
How 0Day would have caught this
gitea is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
If you are running any version of Gitea from 1.17 onward, you are affected by this vulnerability.
What should I do right now?
Immediately upgrade to the latest version of Gitea and review your repository access controls.
Has this been exploited in the wild?
Yes, this vulnerability is being actively exploited by attackers.