A critical argument injection vulnerability in the Gogs Git service allows authenticated users to remotely execute code on a Gogs server by creating a malicious pull request, posing a significant threat to developers who use the platform. The vulnerability, discovered by a Rapid7 researcher, highlights the limitations of relying on small open-source project maintainers for security updates. As the vulnerability remains unpatched, developers are left to take immediate action to secure their code. This lack of response from Gogs maintainers underscores the potential risks of using self-hosted code platforms from small maintainers, who may not have the resources to respond quickly to critical vulnerabilities1. The fact that any authenticated user can exploit this vulnerability makes it particularly concerning, and developers should take steps to mitigate the risk until a patch is available. This vulnerability matters to practitioners because it underscores the need for diligence when relying on open-source projects for critical infrastructure.