Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Gitea | Gitea | unaffected |
|
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Wed, 14 Oct 2026 15:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Gitea substitutes a URL derived from the markup Context field into external renderer command templates without escaping the reference path before shell-style argument splitting. A crafted Context can inject additional renderer arguments, including options that load executable filter files. On deployments using a susceptible external renderer such as pandoc, a user who can place a filter file at an accessible path can cause it to execute as the Gitea service account; the public repository markup endpoint itself can be reachable without authentication. | |
| Title | Gitea external renderer argument injection and code execution | |
| Weaknesses | CWE-88 | |
| References |
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: Gitea
Published:
Updated: 2026-10-14T14:37:44.243Z
Reserved: 2026-08-13T16:50:59.746Z
Link: CVE-2026-73539
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-10-14T15:17:23.633
Modified: 2026-10-14T15:17:23.633
Link: CVE-2026-73539
Redhat
No data.
OpenCVE Enrichment
No data.
-
CWE-88
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')