{"uuid": "aac22ff1-1cf2-49a4-9282-4c904877854f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60004", "type": "seen", "source": "https://t.me/pphm_HackerNews/2376", "content": "\ud83d\udd34 New Gitea RCE Lets Repository Writers Plant a Git Hook to Run Shell Commands\n\nGitea, the self-hosted Git platform, has patched a critical remote code execution vulnerability. A user with ordinary repository write access can turn attacker-controlled patch content into a live Git hook and run shell commands as the Gitea service account.\n\nTracked as CVE-2026-60004 (CVSS score: 9.8), the flaw affects Gitea versions 1.17 and later before 1.27.1 and is fixed in 1.27.1. The vulnerable API call requires authentication and repository write permission. But Gitea enables registration by default, so an outside visitor can create a normal account and repository on an unchanged installation, then exploit the bug without pre-existing credentials.", "creation_timestamp": "2026-08-21T23:00:07.455430Z"}