{"id":"CVE-2024-39930","published":"2024-07-04T00:00:00Z","modified":"2024-08-28T15:22:31Z","title":"The built-in SSH server of Gogs through 0.13.0 allows argument injection in internal/ssh/ssh.go, leading to remote…","vendor":null,"product":null,"tier":"core","eol":null,"description":{"text":"The built-in SSH server of Gogs through 0.13.0 allows argument injection in internal/ssh/ssh.go, leading to remote code execution. Authenticated attackers can exploit this by opening an SSH connection and sending a malicious --split-string env request if the built-in SSH server is activated. Windows installations are unaffected.","provenance":"source","from":"CVE.org"},"summary":{"text":"The built-in SSH server in Gogs through 0.13.0 contains an argument injection flaw in internal/ssh/ssh.go. Remote code execution is possible by an authenticated attacker who connects over SSH and sends a malicious --split-string environment request, provided the built-in SSH server is enabled; Windows installations are not affected.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:53:56Z"},"cvss":{"score":9.9,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:L/S:C/UI:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.07743,"percentile":0.94631,"date":"2026-10-31","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2026-10-21","exploitedFirstSeen":null,"ransomware":false,"evidence":[],"evidenceTotal":0,"provenance":"source"},"exploited":true,"otx":null,"cwes":[{"id":"CWE-88","name":"Improper Neutralization of Argument Delimiters in a Command"}],"references":[{"url":"https://github.com/gogs/gogs/releases","tags":[]},{"url":"https://www.sonarsource.com/blog/securing-developer-tools-unpatched-code-vulnerabilities-in-gogs-1/","tags":[]},{"url":"https://www.vicarius.io/vsociety/posts/argument-injection-in-gogs-ssh-server-cve-2024-39930","tags":[]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Go","package":"gogs.io/gogs","vulnerableRanges":["<0.13.1"],"patched":["0.13.1"],"from":["GHSA-vm62-9jw3-c8w3"],"provenance":"source"},{"ecosystem":"Go","package":"github.com/gogs/gogs","vulnerableRanges":["all versions"],"patched":[],"from":["GO-2024-2969"],"provenance":"source"}],"advisories":[{"id":"GHSA-vm62-9jw3-c8w3","url":"https://github.com/advisories/GHSA-vm62-9jw3-c8w3","severity":"CRITICAL","ecosystem":"Go","package":"gogs.io/gogs","vulnerableRanges":["<0.13.1"],"patched":["0.13.1"],"provenance":"source","from":"GHSA"},{"id":"GO-2024-2969","url":"https://osv.dev/vulnerability/GO-2024-2969","severity":null,"ecosystem":"Go","package":"github.com/gogs/gogs","vulnerableRanges":["all versions"],"patched":[],"provenance":"source","from":"OSV"}],"euvd":{"id":"EUVD-2024-3615","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-3615","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[{"id":52348,"url":"https://www.exploit-db.com/exploits/52348","title":"gogs 0.13.0 - Remote Code Execution (RCE)","type":"remote","platform":"multiple","date":"2025-07-02","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2025-07-02"},"pocGithub":{"count":2,"skipped":1,"earliest":"2025-06-29","earliestUrl":"https://github.com/theMcSam/CVE-2024-39930-PoC","repos":[{"name":"theMcSam/CVE-2024-39930-PoC","url":"https://github.com/theMcSam/CVE-2024-39930-PoC","stars":0,"created":"2025-06-29"},{"name":"alexander47777/-CVE-2024-39930","url":"https://github.com/alexander47777/-CVE-2024-39930","stars":0,"created":"2025-07-22"}]},"first":{"date":"2025-06-29","source":"PoC-in-GitHub","url":"https://github.com/theMcSam/CVE-2024-39930-PoC"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2024-07-04","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2024-39930","provenance":"source"},{"date":"2025-06-29","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub; later: Exploit-DB 2025-07-02","url":"https://github.com/theMcSam/CVE-2024-39930-PoC","provenance":"source"}],"speed":{"daysToPublicExploit":360,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":75.9,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":10.0,"detail":"added 11 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":18.93,"detail":"percentile 0.9463"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 Exploit-DB entry; 2 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":6.93,"detail":"base score 9.9"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}