Cyber Resilience

CVE-2022-1986

CriticalPublic PoCRCE

Published: 09 June 2022

Published
09 June 2022
Modified
21 November 2024
KEV Added
Patch
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0923 92.9th percentile
Risk Priority 25 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2022-1986 is a critical-severity OS Command Injection (CWE-78) vulnerability in Gogs Gogs. Its CVSS base score is 9.8 (Critical).

Operationally, ranked in the top 7.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Deeper analysis

CVE-2022-1986 is an OS command injection vulnerability, tracked as CWE-78, that affects the Gogs Git service in versions prior to 0.12.9. The flaw received a CVSS v3.1 base score of 9.8, reflecting network attackability without authentication or user interaction and full impact on confidentiality, integrity, and availability.

An unauthenticated remote attacker can supply crafted input that results in arbitrary operating-system command execution on the host running the vulnerable Gogs instance, enabling complete compromise of the affected system.

Public references point to a corrective commit (38aff73251cc46ced96dd608dab6190415032a82) that resolves the issue; the corresponding advisory and bounty report therefore recommend upgrading to Gogs 0.12.9 or later.

EPSS for the CVE rose from lower values to a recorded peak of 0.1386 on 2025-12-11 before receding to the current 0.0923, indicating a period of increased exploitation interest after disclosure.

EU & UK References

Vulnerability details

OS Command Injection in GitHub repository gogs/gogs prior to 0.12.9.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

gogs
gogs
≤ 0.12.9

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-78

Platform-independent apps typically execute inside a managed runtime or sandbox that restricts direct OS command execution, reducing the ability to exploit OS command injection.

addresses: CWE-78

Validates inputs to block special elements that would alter OS command execution.

References