A security flaw in Gitea, the open-source platform used by organizations to host Git repositories and manage software development, has moved from a patching concern to an active threat.
CISA has added CVE-2026-60004, a critical remote code execution vulnerability with a CVSS score of 9.8, to its Known Exploited Vulnerabilities (KEV) catalog after confirming that attackers are exploiting it in the wild. Federal agencies have been given until August 28 to apply the required security update.
The flaw is particularly worrying because it abuses something developers routinely do, commit and manage code.
The vulnerability allows an attacker with write access to a Gitea repository to send a specially crafted patch through the platform’s diffpatch API endpoint. That malicious patch can be used to plant an executable Git hook, ultimately allowing the attacker to run arbitrary shell commands with the privileges of the Gitea service account.
And there is an important catch: that write-access requirement may not always provide much protection. Gitea installations with open registration can allow an unauthenticated visitor to create an account and repository, potentially obtaining the permissions needed to exploit the flaw.
Gitea developers patched the vulnerability in version 1.27.1, released in late July. But attackers have already started looking for systems that remain unpatched.
One reported attack shows just how quickly the vulnerability can turn into a real-world compromise. Security researcher Andrey, also known as Causelof, found his Gitea instance being targeted by an unknown actor who used the flaw to deploy a cryptocurrency-miner-like dropper. The attacker effectively turned a software-development server into a resource for mining.
The attacker behind the campaign and their broader objectives remain unclear. However, the incident is a reminder that development infrastructure can be just as attractive to attackers as traditional production systems.
Security teams running self-hosted Gitea should upgrade to 1.27.1 or later immediately, review repository and Git-hookactivity, investigate unusual command execution, and check for unexpected mining-related processes or files.
Let’s refine your stalking skills; go through our Instagram and LinkedIn.
