Gitea Patches Actively Exploited Code Injection Flaw (CVE-2026-60004) — Now in CISA KEV

Gitea has disclosed a code injection vulnerability, tracked as CVE-2026-60004, that CISA has added to its Known Exploited Vulnerabilities (KEV) catalog, indicating confirmed exploitation in the wild. Per the GitHub Security Advisory, an attacker who already has write access to a repository can send a malicious patch to the diffpatch API endpoint to plant an executable Git hook, which then runs shell commands as the Gitea service account.

Why It Matters

Gitea is a widely self-hosted Git service used by organizations that want to keep source control off third-party platforms. This flaw turns a repository-write privilege — something routinely granted to contributors, CI service accounts, or automation bots — into arbitrary command execution on the host running Gitea. Given the target is a code-hosting server, successful exploitation can expose source code, secrets in CI configuration, SSH deploy keys, and potentially provide a foothold for lateral movement into build and deployment infrastructure. Its presence in CISA KEV means this is not theoretical; exploitation has already been observed.

What Defenders Should Do Now

• Identify all self-hosted Gitea instances in your environment and apply the vendor patch referenced in the advisory as soon as possible.
• Review who currently holds repository write access — including bot/service accounts and CI integrations — since that is the minimum privilege required to exploit this issue.
• Audit Git hooks on Gitea-managed repositories for unexpected or unrecognized hook scripts, particularly ones created or modified outside normal deployment workflows.
• Review logs for anomalous calls to the diffpatch API endpoint or unusual patch/PR activity from low-trust or automation accounts.
• Monitor process execution and outbound network activity originating from the Gitea service account for signs of post-exploitation shell commands.
• Where feasible, restrict repository write access and API exposure for Gitea instances that are internet-facing until patching is confirmed.

This is developing intel based on a same-day CISA KEV addition; further technical detail (exploitation TTPs, affected version ranges, IOCs) may emerge as the advisory matures. For authoritative details, see Gitea's advisory: GHSA-rcr6-4jqh-j84m.