SECURITY_THREAT_PULSE
LIVE
LAST UPDATED
FIRST SEEN
5 SOURCES ON THIS EVENT
▲ ACT NOWCVE-2026-60004 · CVSS 9.8

Gitea: attackers can run their own code

AFFECTSGitea

OFFICIAL NAME: Gitea Code Injection Vulnerability

WHAT IT IS · DEVELOPER TOOLSIt holds source code and the keys used to build and ship software.

DO THIS FIRSTPatch it. If it faced the internet, change the keys and passwords stored in it. Not sure if you use it? Send this page to your IT provider or security lead and ask.

TECHNICAL SUMMARY Gitea contains a code injection vulnerability that allows an attacker with repository write access to send a malicious patch to the diffpatch API endpoint to plant an executable Git hook and run shell commands as the Gitea service account.

WHY THIS VERDICT Attacks are confirmed. The vulnerability is 59 days old, so current versions are being attacked. Ready-made attack tools are public. The severity score is critical (9.8).

HIGHEST CONFIRMED RUNG
EXPLOITED
CISA KEV
LISTED
EXPLOIT CODE
READY TO USE
// EVIDENCE LADDER

How far has it climbed?

CONFIRMED
REPORTED
NO EVIDENCE

  1. 01 TALK

    ▨ REPORTED, NOT CONFIRMED
    NEWEST EVIDENCE NONE YET · 1 SOURCE

    Evidence is recorded but no summary is available.

    SRC: NONE YET

  2. 02 EXPOSED

    □ NOT TRACKED YET
    NO SOURCE FOR THIS STEP YET

    We have no source that counts exposed systems yet. Internet scan data needs a partnership we do not have. No evidence here does not mean nothing is exposed.

  3. 03 TRIED

    ■ CONFIRMED
    NEWEST EVIDENCE · 2 INDEPENDENT SOURCES

    Attacks that worked are confirmed (step 4), so attempts count as confirmed too.

  4. 04 EXPLOITED

    ■ CONFIRMED
    NEWEST EVIDENCE · 2 INDEPENDENT SOURCES

    CISA Vulnrichment marks CVE-2026-60004 as actively exploited. Gitea contains a code injection vulnerability that allows an attacker with repository write access to send a malicious patch to the diffpatch API endpoint to plant an executable Git hook and run shell commands as the Gitea service account.

  5. 05 DAMAGE

    □ NOT TRACKED YET
    NO SOURCE FOR THIS STEP YET

    Breach notices and filings rarely name the flaw that was used, so we cannot link them to this event yet. No evidence here does not mean no harm.

// THE CLOCK

When each thing happened

  1. DISCLOSED
    CVE-2026-60004 published
  2. EXPLOIT CODE PUBLIC
    CIRCL Vulnerability-Lookup sightings
  3. FIRST ATTACK REPORT
    CISA Known Exploited Vulnerabilities
  4. CISA KEV LISTING
    CISA KEV listing
  5. US FEDERAL DEADLINE
    CISA deadline for US federal agencies
Attacks were reported on or before the day the flaw was disclosed.

THE FIX

CISA's instruction: apply the vendor's fix, or stop using the product if no fix exists. The deadline CISA set for US federal agencies, Aug 28, 2026, has passed. It is a US government deadline; use it as a guide.

// ASK YOUR TEAM

Questions to ask this week

// TIMELINE · PACIFIC TIME

How it unfolded

  1. AUG 3, 2026
    Vulnerability CVE-2026-60004 confirmed by a researcher (CIRCL sighting)
  2. Attack activity. AUG 24, 2026
    Gitea Code Injection Vulnerability
  3. Attack activity. AUG 26, 2026
    CISA Vulnrichment marks CVE-2026-60004 as actively exploited
  4. OCT 20, 2026
    Gitea security advisory (AV26-845) - Update 1

SOURCES

  1. [1] nuclei-templates: Nuclei scan template: Gitea <= 1.27.0 - Pre-Auth Remote Code Execution, OCT 24
  2. [2] Canadian Centre for Cyber Security: Gitea security advisory (AV26-845) - Update 1, OCT 20
  3. [3] CVE List V5 and CISA Vulnrichment: CISA Vulnrichment marks CVE-2026-60004 as actively exploited, AUG 26
  4. [4] CISA Known Exploited Vulnerabilities: Gitea Code Injection Vulnerability, AUG 24
  5. [5] CIRCL Vulnerability-Lookup sightings: Vulnerability CVE-2026-60004 confirmed by a researcher (CIRCL sighting), AUG 3