New Gogs zero-day flaw lets hackers get remote code execution

Critical severity argument injection vulnerability in Gogs self-hosted Git service affecting versions 0.14.2 and 0.15.0+dev. Exploitable by authenticated attackers without admin privileges through pull requests using malicious branch names to inject the '--exec' flag into git rebase during 'Rebase before merging' operations. Default configuration allows open registration and unlimited repository creation, enabling unauthenticated attackers to create accounts and exploit the vulnerability. Similar to previously patched argument injection flaws but affects a different code path (Merge()) that was never patched.