CVE-2026-73539 Gitea external renderer argument injection and code execution

Gitea substitutes a URL derived from the markup Context field into external renderer command templates without escaping the reference path before shell-style argument splitting. A crafted Context can inject additional renderer arguments, including options that load executable filter files. On...

CVE-2026-73539

Gitea is vulnerable to argument injection and remote code execution due to a failure to escape the reference path when substituting a URL derived from the markup Context field into external renderer command templates. The root cause lies in routers/common/markup.go, where the branch path is assig...