The Cybersecurity and Infrastructure Security Agency has added a newly disclosed Gitea vulnerability to its Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild.
The flaw, tracked as CVE-2026-60004, affects Gitea, a widely used self-hosted Git service popular among developers and enterprises that manage source code repositories.
The security issue is classified as a code injection vulnerability, mapped to CWE-94, which covers improper control of code generation.
According to CISA, Gitea contains a flaw that allows an attacker with repository write access to send a malicious patch to the diffpatch API endpoint.
This crafted patch can plant an executable Git hook on the server, allowing the attacker to run arbitrary shell commands with the privileges of the Gitea service account.
This attack path is particularly dangerous because it does not require administrative access, only write permissions to a repository, a level of access many collaborators or contributors typically hold.
Gitea Code Injection Vulnerability Exploited
Once the malicious hook is planted, it executes automatically during normal Git operations, giving attackers a stealthy way to escalate control over the underlying server.
CISA has not confirmed whether this vulnerability has been used in ransomware campaigns, listing its status as unknown at this time. Forensic triage under Binding Operational Directive 26-04 is not currently required for this flaw.
The vulnerability was added to CISA’s KEV catalog on August 25, 2026, with a remediation deadline of August 28, 2026, giving affected organizations a narrow window to act.
CISA is directing agencies and stakeholders to apply mitigations in accordance with vendor instructions while ensuring compliance with BOD 26-04, which prioritizes security updates based on risk.
Organizations running cloud-hosted Gitea instances must follow applicable BOD 26-04 guidance for cloud services, or discontinue use of the product entirely if no mitigation is available.
CISA emphasizes that stakeholders are responsible for evaluating each affected asset’s internet exposure and ensuring timely patching in accordance with directive guidelines.
Self-hosted Git platforms like Gitea are core infrastructure for software development teams, making them high-value targets for attackers seeking to inject malicious code into software supply chains.
Organizations using Gitea should audit repository access controls, review recent patch and hook activity, and apply vendor-issued fixes without delay.
Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC
The post CISA Warns of Gitea Code Injection Vulnerability Exploited in Attacks appeared first on Cyber Security News.
