Federal cybersecurity regulators have issued an emergency addition to the Known Exploited Vulnerabilities catalog, mandating rapid patching for a self-hosted Git developer platform. The vulnerability permits remote actors to transmit crafted diffpatch requests to plant malicious executable Git hooks, achieving arbitrary shell command execution on underlying host servers.
The vulnerability, tracked as CVE-2026-60004, impacts Gitea releases prior to version 1.27.1. The issue resides within the diffpatch API endpoint handling patch-format changes submitted to repository trees. An attacker with repository write access, or an anonymous user on instances featuring open registration, can submit crafted patch data to install custom Git execution hooks. When triggered, the planted hooks execute system commands under the Gitea service account. Active wild exploitation telemetry confirms attackers leveraging the bug to deploy persistent cryptomining droppers. CISA has set an August 28 mitigation deadline under Binding Operational Directive 26-04.
Subverting developer source control platforms introduces extreme software supply chain risk across the enterprise. Because self-hosted Git repositories manage sensitive source code, deployment tokens, and build configurations, an administrative takeover allows threat actors to inject malicious code into software builds, steal intellectual property, and pivot into corporate continuous integration subnets.
– Force immediate software maintenance upgrades across all Gitea instances to release version 1.27.1 or higher.
– Restrict Gitea registration parameters by enforcing administrator approval or invite-only user signup models.
– Inspect host process telemetry for anomalous shell command executions or cryptomining processes originating from Gitea daemon users.
– Audit self-hosted repository hook directories for unrecognized executable files or suspicious diffpatch modification entries.
Developer forge security depends on strict API input sanitization and prompt patch deployment to ensure centralized source code platforms remain completely protected from unauthenticated code injection payloads. #CodeDefence #Gitea #SupplyChain #CodeInjection #RCE #DevSecOps #CISA #KEV
/
