code injection

CVE-2026-60004 — code injection in Gitea leading to command execution on the server

Code injection (CWE-94, CVSS 9.8, KEV) in the diffpatch endpoint of Gitea 1.17 through 1.27.0. It ends with a malicious Git hook that runs commands as the Gitea OS user; the vendor lists application secrets, database credentials, OAuth tokens and mounted repositories as reachable from there. Updating to 1.27.1 is the fix — but the key point is the privilege condition: 'write access required' is satisfied by anyone the moment open registration is on.