PT-2026-51624 · Go · Gogs.Io/Gogs

Published 2026-06-23 · Updated 2026-06-23 · CVE-2026-52806

X.com · Dailycve

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

🔵 Gogs: Argument Injection in PR Merge Leading to Remote Code Execution (#CVE-2026-52806) -DC-Jun2026-579

https://t.co/kovWbNTQ0x

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2026-52806

GHSA-QF6P-P7WW-CWR9

Affected Products

Gogs.Io/Gogs

References · 7

• https://osv.dev/vulnerability/GHSA-qf6p-p7ww-cwr9 · Vendor Advisory
• https://github.com/gogs/gogs/security/advisories/GHSA-qf6p-p7ww-cwr9 · Note
• https://github.com/gogs/gogs/commit/a9dbafbfd8e1020bacc626420238c01d75d03364 · Note
• https://github.com/gogs/gogs/pull/8301 · Note
• https://github.com/gogs/gogs/releases/tag/v0.14.3 · Note
• https://github.com/gogs/gogs · Note
• https://twitter.com/dailycve/status/2069484776029892823 · Twitter Post