{"cvss":9.9,"datePublished":"2026-10-21T00:00:00Z","dateUpdated":"2026-10-21T00:00:00Z","description":"The built-in SSH server of Gogs through 0.13.0 allows argument injection in internal/ssh/ssh.go, leading to remote code execution. Authenticated attackers can exploit this by opening an SSH connection and sending a malicious --split-string env request if the built-in SSH server is activated. Windows installations are unaffected.","dueDate":"","id":"CVE-2024-39930","kev_catalogs":["vulncheck"],"knownRansomwareCampaignUse":"Unknown","product":"Gogs","requiredAction":"Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.","severity":"CRITICAL","source":"vulncheck_kev","title":"Gogs Gogs Improper Neutralization of Argument Delimiters in a Command","vendor":"Gogs"}