CVE-2026-60004 is a code injection vulnerability in Gitea Gitea. CISA added it to the Known Exploited Vulnerabilities catalogue on 25 August 2026, which means attackers have used it in real attacks. Organisations running the affected product should apply the vendor fix or mitigation as a priority.
What this vulnerability means in practice
Code injection in a source-code management platform is dangerous because the application itself can become the execution path. If an attacker can influence what the server interprets as code, they may move from application-layer input handling into server-side execution, which can expose repositories, credentials, or build workflows.
For Gitea-specific version and patch details, organisations should rely on the vendor advisory and the NIST National Vulnerability Database or the CVE Program, rather than reconstructing affected versions from secondary summaries.
Why code injection is especially serious in a code hosting product
Code hosting platforms sit close to the software supply chain, so a successful injection issue can have a wider blast radius than a typical web bug. A compromised instance may expose repository contents, release assets, automation tokens, or CI/CD secrets, and those assets can be reused to pivot into downstream systems.
This is why code injection in developer tooling is often treated as more than an availability issue. It can create a trusted execution foothold inside the environment that stores, moves, or publishes software, which makes the compromise valuable even when the initial payload seems narrow.
How organisations should assess exposure
The first question is whether the vulnerable Gitea instance exists anywhere in the estate, including shadow or test deployments. Asset inventory, external exposure review, and vendor guidance are the fastest ways to determine whether the service is reachable by attackers or only by internal users.
Exposure assessment should also include adjacent systems that trust Gitea, such as runners, webhooks, deployment jobs, and identity integrations. If the platform can reach secrets or automation credentials, compromise of the application can become compromise of the wider delivery path.
Remediation, detection, and post-incident review
Where a patch or mitigation cannot be applied immediately, reduce the reachable attack surface by restricting access, tightening administrative exposure, and disabling unnecessary integrations until the issue is resolved. The Vulnerability Management Guide is useful for prioritising the fix against other known-exploited issues and tracking verification after remediation.
Detection should look for unusual server-side execution paths, unexpected configuration changes, new web shells or spawned processes, and repository or token access that does not fit normal administration patterns. After patching, review whether the instance was used to access secrets, service accounts, or deployment credentials, and rotate anything that may have been exposed.
Risk and Threat Considerations
This vulnerability matters because code injection in a Gitea deployment can turn a collaboration platform into an execution platform for an attacker. The main risk is not only direct system compromise, but also the theft or abuse of developer and automation credentials that can be used for follow-on access.
Failure mechanism: An attacker abuses the injection flaw to run code in the application context, then harvests tokens, secrets, or repository-linked automation rights to extend access beyond the original server.
Impact: The compromise can lead to source-code exposure, CI/CD abuse, malicious release activity, and broader environment intrusion if trusted integrations are reachable from the Gitea instance.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP API Security Top 10 addresses the attack and risk surface, while NIST SP 800-53 Rev 5, CIS Controls v8 and OWASP ASVS set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | SI-3 — Malicious Code Protection | Code injection directly concerns execution of malicious code in the platform. |
| IA-5 — Authenticator Management | Exploitation can expose tokens, secrets, and automation credentials that require lifecycle control. | |
| Recommendation — Apply SI-3 to block, detect, and contain unexpected code execution paths. Rotate exposed authenticators and enforce credential lifecycle controls after compromise. | ||
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | The term is an actively exploited CVE requiring prioritised remediation and validation. |
| Recommendation — Prioritise the fix, verify exposure, and confirm remediation with repeated scanning. | ||
| OWASP ASVS | V15 — Secure Coding and Architecture | Code injection is a core application security failure addressed by secure design and coding verification. |
| Recommendation — Review the affected code path and harden input handling against injection. | ||
| OWASP API Security Top 10 | API8 — Security Misconfiguration | Exploitation often becomes easier when exposed administrative and integration surfaces are misconfigured. |
| Recommendation — Harden exposed interfaces and remove unnecessary attack surface around the service. | ||
Practitioner Guidance
Why practitioners should care: Treat this as a platform compromise issue, not just a web-input flaw. In code-hosting environments, the practical question is what the application can reach after execution, because that determines whether the incident stays local or becomes a supply-chain event.
What to watch for: Prioritise rapid verification of exposure, then validate whether any secrets, tokens, or integration credentials were accessible from the affected instance. If there is any credible sign of exploitation, rotate the identity material that could have been touched and review downstream systems for misuse.