Gitea Code Injection Flaw Actively Exploited, CISA Warns The Cybersecurity and Infrastructure Security Agency (CISA) has added a critical Gitea vulnerability to its Known Exploited Vulnerabilities (KEV) catalog after confirming active exploitation in the wild. Tracked as CVE-2026-60004, the flaw affects Gitea a popular self-hosted Git service used by developers and enterprises to manage source code repositories. The vulnerability, classified as a code injection issue (CWE-94), allows attackers with repository write access to exploit the diffpatch API endpoint by submitting a malicious patch. This patch plants an executable Git hook on the server, enabling arbitrary shell command execution under the privileges of the Gitea service account. Notably, the attack does not require administrative access only write permissions, a level of access commonly granted to collaborators. Once deployed, the malicious hook executes automatically during routine Git operations, providing attackers with a stealthy method to escalate control over the server. While CISA has not confirmed links to ransomware campaigns, the agency has set a remediation deadline of August 28, 2026, for federal agencies and stakeholders, following its addition to the KEV catalog on August 25, 2026. Organizations using self-hosted or cloud-based Gitea instances are urged to apply vendor-issued patches immediately, audit repository access controls, and review recent patch and hook activity. The flaw underscores the risks to software supply chains, as self-hosted Git platforms remain prime targets for attackers seeking to inject malicious code. Compliance with Binding Operational Directive (BOD) 26-04 is required, with cloud-hosted instances subject to additional guidance or potential discontinuation if mitigations are unavailable.