A critical argument injection vulnerability has been discovered in Gogs, a self-hosted Git service, allowing authenticated users to execute remote code on the server. This vulnerability, scored 9.4 on the CVSSv4 scale, enables attackers to inject malicious commands into the git rebase function during a merge operation by creating a pull request with a specially crafted branch name. The exploit requires no administrative privileges, making it accessible to any authenticated user. The vulnerability is particularly concerning as it remains unfixed by the vendor at the time of publication1. This lack of a patch leaves Gogs users exposed to potential attacks, highlighting the need for alternative mitigation strategies. The ability to achieve remote code execution on the server makes this vulnerability a significant concern for security practitioners, as it could be leveraged to gain unauthorized access to sensitive data and systems.