Gitea vulnerable to Argument Injection

CRITICAL 9.8CVE-2022-42968 · BIT-gitea-2022-42968 · GHSA-w8xw-7crf-h23x · Published 16/10/2022 · updated 17/06/2026

In short

CVE-2022-42968 is a CRITICAL (CVSS 9.8) vulnerability affecting code.gitea.io/gitea, github.com/go-gitea/gitea, gitea (gitea).
Chance of exploitation in the next 30 days (EPSS): 1.4%, higher than 72.4% of all vulnerabilities.
Fix: update to 1.17.3 or later.

Gitea before 1.17.3 does not sanitize and escape refs in the git backend. Arguments to git commands are mishandled.

NVD description

Gitea before 1.17.3 does not sanitize and escape refs in the git backend. Arguments to git commands are mishandled.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

< 1.17.3

1.17.3

< 1.17.3

1.17.3

< 1.17.3

1.17.3

More vulnerabilities in code.gitea.io/gitea

See all →