CVE-2022-42968

Gitea vulnerable to Argument Injection

9.8 CriticalFix available

CVE-2022-42968 is a critical vulnerability (CVSS 9.8) in Gitea, published October 16, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.43%, the 73rd percentile. Fixed in github.com/go-gitea/gitea 1.17.3.

What does this mean?

Severity: 9.8 CriticalCVSS 3.1, NVD
Exploit chance: 1.43%EPSS, 73rd percentile
Exploitation: None knownNot on CISA’s or ENISA’s lists
Fixed in: 1.17.3github.com/go-gitea/gitea +10 more

Description

Gitea before 1.17.3 does not sanitize and escape refs in the git backend. Arguments to git commands are mishandled.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

1.43%Up 0.5 points since Oct 16, 2022

Affected products

gitea

Affected packages

Affected packages
Package	Affected	Fixed
`github.com/go-gitea/gitea` Go	before 1.17.3	1.17.3
`gitea` Alpine:v3.17	before 1.17.3-r0	1.17.3-r0
`gitea` Alpine:v3.18	before 1.17.3-r0	1.17.3-r0
`gitea` Alpine:v3.19	before 1.17.3-r0	1.17.3-r0
`gitea` Alpine:v3.20	before 1.17.3-r0	1.17.3-r0
`gitea` Alpine:v3.21	before 1.17.3-r0	1.17.3-r0
`gitea` Alpine:v3.22	before 1.17.3-r0	1.17.3-r0
`gitea` Alpine:v3.23	before 1.17.3-r0	1.17.3-r0
`gitea` Alpine:v3.24	before 1.17.3-r0	1.17.3-r0
`gitea` Bitnami	before 1.17.3	1.17.3
`code.gitea.io/gitea` Go	before 1.17.3	1.17.3

What each source reports

NVD Score used9.8

Gitea before 1.17.3 does not sanitize and escape refs in the git backend. Arguments to git commands are mishandled.

Record: CVE-2022-42968
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-88
Updated: 2026-11-02

CVE List9.8

Gitea before 1.17.3 does not sanitize and escape refs in the git backend. Arguments to git commands are mishandled.

Record: CVE-2022-42968
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-88
Updated: 2026-11-02

EUVDEUVD-2022-71739.8

Gitea before 1.17.3 does not sanitize and escape refs in the git backend. Arguments to git commands are mishandled.

Record: EUVD-2022-7173
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-w8xw-7crf-h23x9.8

Gitea vulnerable to Argument Injection

Gitea before 1.17.3 does not sanitize and escape refs in the git backend. Arguments to git commands are mishandled.

Record: GHSA-w8xw-7crf-h23x
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-88
Updated: 2026-11-02

OSVALPINE-CVE-2022-429689.8

Gitea before 1.17.3 does not sanitize and escape refs in the git backend. Arguments to git commands are mishandled.

Record: ALPINE-CVE-2022-42968
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-03

OSV9.8

Gitea before 1.17.3 does not sanitize and escape refs in the git backend. Arguments to git commands are mishandled.

Record: CVE-2022-42968
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVGHSA-w8xw-7crf-h23x9.8

Gitea vulnerable to Argument Injection

Gitea before 1.17.3 does not sanitize and escape refs in the git backend. Arguments to git commands are mishandled.

Record: GHSA-w8xw-7crf-h23x
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-88
Updated: 2026-11-02

OSVBIT-gitea-2022-42968No score

Gitea before 1.17.3 does not sanitize and escape refs in the git backend. Arguments to git commands are mishandled.

Record: BIT-gitea-2022-42968
Updated: 2026-11-02

OSVGO-2022-1065No score

Gitea vulnerable to Argument Injection in code.gitea.io/gitea

Gitea vulnerable to Argument Injection in code.gitea.io/gitea

Record: GO-2022-1065
Updated: 2026-11-02

History

History
Recorded	Changed	Sources
Nov 3, 2026	affected, aliases, references	OSV
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

Description

Attack profile

How easy it is to exploit

What an attacker can affect

Exploit likelihood

Affected products

Affected packages

What each source reports

History

References