Description
The built-in SSH server of Gogs through 0.13.0 allows argument injection in internal/ssh/ssh.go, leading to remote code execution. Authenticated attackers can exploit this by opening an SSH connection and sending a malicious --split-string env request if the built-in SSH server is activated. Windows installations are unaffected.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- gogs 0.13.0 - Remote Code Execution (RCE) EDB-52348 · remote · Jul 2, 2025
GitHub 3 repositories
-
laachy/CVE-2024-39930-ptrace-detection-mitigation ★ 0 · Oct 13, 2025
-
alexander47777/-CVE-2024-39930 ★ 0 · Jul 22, 2025
Gogs Under Attack: Unpacking the Critical SSH Vulnerability (CVE-2024–39930)
-
theMcSam/CVE-2024-39930-PoC ★ 0 · Jun 29, 2025
Exploit Code for CVE-2024-39930 gogs ssh server RCE
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/gogs/gogs | all versions | — | GO-2024-2969 |
| Go | gogs.io/gogs | < 0.13.1 | 0.13.1 | GHSA-vm62-9jw3-c8w3 |
Advisories 1
- WID-SEC-2026-2013 Gogs: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 24, 2026