Federal cybersecurity authorities have confirmed active exploitation of a severe code injection vulnerability impacting self-hosted instances of the open-source Gitea Git platform.
The Cybersecurity and Infrastructure Security Agency added CVE-2026-60004 to its Known Exploited Vulnerabilities catalog on Tuesday. The critical security flaw resides within Gitea’s diffpatch endpoint, enabling unauthorized actors to abuse repository-controlled content to install and execute malicious Git hooks.
According to technical advisories released by platform maintainers, the flaw grants remote code execution capabilities directly to the Gitea service account. “An attacker with ordinary write access to a repository can execute arbitrary shell commands as the Gitea OS user,” maintainers explained, noting that deployments with open user registration enabled allow unauthenticated visitors to immediately register accounts, initialize repositories, and execute the exploit chain.
Recent incident reporting highlighted an active attack in which an automated scanner targeted an outdated, unpatched Gitea instance configured without email verification or CAPTCHA protections. The compromise successfully deployed a crypto-mining dropper within the containerized environment, causing sustained high CPU utilization before administrators intervened and terminated the rogue process.
Project maintainers patched the vulnerability in Gitea v1.27.1 and subsequently urged system administrators to upgrade immediately to Gitea v1.27.2. In addition to patching binaries, security teams are advised to disable open registrations, rotate configuration secrets, and enforce strict egress filtering on container networking to prevent unauthorized outbound communications.