New Gitea RCE Lets Repository Writers Plant a Git Hook to Run Shell Commands

A critical remote code execution vulnerability has been patched in Gitea, a self-hosted Git platform. The flaw allows a user with ordinary repository write access to create a live Git hook from attacker-controlled patch content, enabling them to run shell commands as the Gitea service account. The vulnerability, tracked as CVE-2026-60004 with a CVSS score of 9.8, affects Gitea versions 1.17 and later, up to version 1.27.1. The issue is fixed in version 1.27.1 of Gitea. This vulnerability can be exploited by repository writers to execute malicious commands. The patch resolves the remote code execution risk.