Home Today’s Briefing Deep Dives In Play Trending For You Discover My Stack Saved Off Radar Search

Loading today’s stories

Today

AI-assisted reporting, grounded in a per-article claim ledger. Perspective Coverage and Reality Strip separate source viewpoints from evidence, adoption, hype, incentives, and confidence.

Today

Front Page
Today’s Briefing
Newsletters
Trending
For You
Discover
My Stack
Saved
Off Radar
Search

Sections

Security
Build
Invest
Product
Leadership
Science

Company

About
Mission
How this is made
Evidence Index
The desks
The sources we read
Corrections
Press and brand
The daily edition

Trending now

Software Supply Chain Security
AI Infrastructure Buildout
Agentic AI Security
Agentic coding workflows
AI Agent Security
Women's health research
Embodied AI
China Robotics Industry
Child Online Safety
AI infrastructure M&A

How this is made

Today For You My Stack Off Radar Search

Argument injection in Git tooling — Clarity Today

Topic

Argument injection in Git tooling

User-controlled input reaching Git subcommands without an end-of-options delimiter, turning values such as branch names into flags like --exec.

Current clusters

security2 distinct publishers

CVE-2026-52806 turns a Gogs branch name into command execution as the git user

Rapid7 scored it 9.9 and Gogs shipped 0.14.3 on June 7, 2026. The reason it rates that high is configuration: open registration and unlimited repository creation let a stranger own the repo they attack from.

Publishers:rapid7.com · runzero.com

Reality

Evidence84
Adoption52
Hype gap+14
Incentives72

Confidence74