CVE-2022-1986
Published: 09 June 2022
Summary
CVE-2022-1986 is a critical-severity OS Command Injection (CWE-78) vulnerability in Gogs Gogs. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 7.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
CVE-2022-1986 is an OS command injection vulnerability, tracked as CWE-78, that affects the Gogs Git service in versions prior to 0.12.9. The flaw received a CVSS v3.1 base score of 9.8, reflecting network attackability without authentication or user interaction and full impact on confidentiality, integrity, and availability.
An unauthenticated remote attacker can supply crafted input that results in arbitrary operating-system command execution on the host running the vulnerable Gogs instance, enabling complete compromise of the affected system.
Public references point to a corrective commit (38aff73251cc46ced96dd608dab6190415032a82) that resolves the issue; the corresponding advisory and bounty report therefore recommend upgrading to Gogs 0.12.9 or later.
EPSS for the CVE rose from lower values to a recorded peak of 0.1386 on 2025-12-11 before receding to the current 0.0923, indicating a period of increased exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-5955
Vulnerability details
OS Command Injection in GitHub repository gogs/gogs prior to 0.12.9.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.