If you self-host Gogs, check this out immediately. A critical unpatched RCE has been disclosed in Gogs involving the pull request rebase/merge flow. The issue is an argument injection bug where a malicious branch name using --exec can be passed into git rebase and treated as a Git option, leading to command execution as the Gogs server user, usually git. submitted by /u/raptorhunter22 [link] [comments]