> PR: Critical: fix: prevent template expansion from interfering with git repo initialization. When generating a new repository from a template repository, Forgejo clones the template repository, removes the .git folder, performs variable template expansion on files listed in .forgejo/template, and initializes a new git repository. During this process, variable template expansion could be misused in order to create a new .git folder, which git would adopt and incorporate during its initialization of a new git repository. A malicious template repository could be used to read arbitrary data from the Forgejo host, and to execute arbitrary processes on the Forgejo host, as a remote code execution attack. To address this issue, after variable expansion is completed, any existing .git folder is removed from the directory before the git repository is initialized.
If you have open registrations or otherwise users you don't 100% trust with the ability to create new repository (which is the default I think?), they could potentially exploit this and you probably wanna upgrade ASAP.
If you have only trusted users, or single user, seems it's fine. Of course, wanna upgrade anyway to not add escalation paths, but in the other situation it's graver.
What happened to sandboxing the offending git invocation?
(bias note: part of project leadership of Gitea)
Edit: As a note, security incidents happen to everyone and we shouldn't shame anyone for reporting them, especially as that'd otherwise cause less issues to be reported overall.
Is Gitea's immunity just incidental because it was written by a different person, or is it due to a deliberate defensive system that prevents such bug/mistake from occurring?
PR: https://github.com/go-gitea/gitea/pull/36734
So likely Gitea < 1.25.5 was vulnerable.
They may not use AI to check for vulnerabilities but attackers are going to which puts themselves at the disadvantage.
https://codeberg.org/Codeberg/org/commit/71149c7fc95ccfeae36...
Forgejo disallows LLM contributions, including using a "general AI" (they include LLMs under "general AI") for reviews[0]:
> 5. Using general AI for review is forbidden. If the change contains changes to the UX it has to be approved by a human reviewer.
[0] https://codeberg.org/forgejo/governance/src/branch/main/AIAg...
The rule you quoted is about code reviews, they don't want you using an LLM to write reviews or leave comments.
This is a pretty poorly written policy to be honest, so I understand if you interpret it to mean "no LLMs in any capacity", but I think if that's what they meant they would have said that. In fact they explicitly allow content "made with the help of AI", you just have to disclose it.
>Vibe coding is the practice where AI creates a code change (feature, bug fix, tests, refactor) with a human that describes what needs to be implemented.
So if you let an AI prompt another AI without human input, that's not vibe coding? Meanwhile if you prompt the model with pseudo code you've written or code written in another programming language to translate into the target language, that's vibe coding?
>It is not allowed to use AI in an autonomous-looking way to contribute in Forgejo.
They used the word "in", meaning it could refer to organizational membership, their repo or theoretically any instance of Forgejo, including self hosted ones. They failed to specify what part of Forgejo or the definition of Forgejo they meant.
Overall this is a pretty poorly written document and when you think about it, it doesn't really matter how poorly written it is when they are basically 100% against AI.
You're misreading the rule.
>> 5. Using general AI for review is forbidden.
The second sentence makes it even clearer, as it would have been unnecessary under a blanket ban scenario
>> ... If the change contains changes to the UX it has to be approved by a human reviewer.
> Forgejo does not accept works of authorship (code, documentation, etc.) either partially or completely generated by AI due to legal uncertainties.Would that not imply that a change that does not effect the UX does not have to be approved by a human reviewer? Otherwise, why specifically call out "changes to the UX" and not say "all changes"?
You are implying that just by allowing LLM contributions your product is free of bugs, and the LLM won't introduce new bugs. Of course, if the LLM introduces bugs, the solution is to add another layer of LLM looking for bugs, ad infinitum.
Another post from today from Shopify, praising LLM to code their frontend, also stated that their LLM generated code is not ready to deploy, and needs to be reviewed:
> It’s tempting to just point an LLM to the React Native codebase and try to one-shot the same features in native, but it doesn’t work. Even if you ask it to gather as much information as it can up front, freeze that into specs, task files, and then implement it, you end up with a huge amount of unmaintainable code that can’t be shipped. [...] each [build] must prove its behavior with tests, match the running app in a visual review, survive two adversarial code reviewers, and get a human's nod before it's committed and the next one starts.
That... is not the implication of the comment you're replying to.
You don't need to make it all fundamentalist.
you didn't read the comment, did you?
Go back and read the threads. On this forum, or on mastodon, or on the vote. It was pretty vociferously ... shall we say ... "principled"
It was never stated to be about "low quality" but about use in "large part" or "majority", and when pressed people refused to define what that meant, and in fact got angry and defensive and said things like "you'll know if you've crossed the line" and "stop trying to force consent" and similar pearls of wisdom.
The post-facto rationalization did in fact leave them room to judge "quality" on a purely subjective basis. I didn't stick around to find out how that would shake out.
>6. It is not allowed to use AI in an autonomous-looking way to contribute in Forgejo. This also applies when someone engages in 'vibe coding' or uses so-called 'agent mode'.
https://codeberg.org/forgejo/forgejo/pulls/14301:
*Critical:* fix: prevent template expansion from interfering with git repo initialization. When generating a new repository from a template repository, Forgejo clones the template repository, removes the `.git` folder, performs variable template expansion on files listed in `.forgejo/template`, and initializes a new git repository. During this process, variable template expansion could be misused in order to create a new `.git` folder, which git would adopt and incorporate during its initialization of a new git repository. A malicious template repository could be used to read arbitrary data from the Forgejo host, and to execute arbitrary processes on the Forgejo host, as a remote code execution attack. To address this issue, after variable expansion is completed, any existing `.git` folder is removed from the directory before the git repository is initialized.
https://codeberg.org/forgejo/forgejo/pulls/14301:
ensure authorization reducer is accessed when checking editable PRs in APIs. When editing a git repo contents through Forgejo's API, a specialized security control is used to permit repository maintainers to edit branches that they do not own when an open pull request with the "allow maintainer edit" option is present. This specialized security control did not take into account API-specific security restrictions, such as repo-specific access tokens. As a result, it was possible for an API access token with restricted permission to make modifications outside of that restricted permission. The specialized security control has been updated to take into account API authentication security restrictions.
---
So if like me you run a private forgejo instance with closed signups and limited repository creation, you can wait for the update. Otherwise maybe take it off the public internet for a bit?
// Before template expansion, .git was removed so that a fresh repo can be initialized; remove it again in case
// some template variable usage has conflicted with this directory and impacts git operations.
if err := root.RemoveAll(".git"); err != nil {
return fmt.Errorf("unable to remove .git folder")
}
User/operator can't really fix the problem if you keep giving them information this vague.
Security bug fixes
PR: Critical: fix: prevent template expansion from interfering with git repo initialization. When generating a new repository from a template repository, Forgejo clones the template repository, removes the .git folder, performs variable template expansion on files listed in .forgejo/template, and initializes a new git repository. During this process, variable template expansion could be misused in order to create a new .git folder, which git would adopt and incorporate during its initialization of a new git repository. A malicious template repository could be used to read arbitrary data from the Forgejo host, and to execute arbitrary processes on the Forgejo host, as a remote code execution attack. To address this issue, after variable expansion is completed, any existing .git folder is removed from the directory before the git repository is initialized.Any mirror?
Critical: fix: prevent template expansion from interfering with git repo initialization. When generating a new repository from a template repository, Forgejo clones the template repository, removes the .git folder, performs variable template expansion on files listed in .forgejo/template, and initializes a new git repository. During this process, variable template expansion could be misused in order to create a new .git folder, which git would adopt and incorporate during its initialization of a new git repository. A malicious template repository could be used to read arbitrary data from the Forgejo host, and to execute arbitrary processes on the Forgejo host, as a remote code execution attack. To address this issue, after variable expansion is completed, any existing .git folder is removed from the directory before the git repository is initialized.Yep this is an RCE with the forgejo user on the host.
https://www.pruva.dev/reproductions/REPRO-2026-00345 for details.
you can even start your version of the repro using github codespaces
========================================
REPRO-2026-00345
========================================
Title: Forgejo <16.0.4 RCE via crafted template repository (.forgejo/template expansion recreates .git folder adopted by git init)
Severity: CRITICAL
CVE: CVE-2026-89094
========================================
[pruva] Working directory: /workspaces/pruva-sandbox/pruva-results/REPRO-2026-00345
[pruva] Found script artifact: bundle/repro/reproduction_steps.sh
[pruva] Downloaded 4 repro artifact(s), script: 324 lines
[pruva] ==========================================
[pruva] WARNING: This will execute code that
[pruva] exploits a real vulnerability.
[pruva] ==========================================
[pruva] Auto-confirming in sandbox environment...
[pruva] Running reproduction script...
--- REPRODUCTION OUTPUT ---
[09:39:29] ensuring container images are present
[09:39:42] vulnerable image digest: sha256:214f4ae63ee78be1e445e58573c88dc7215e72091210852e0df94eaac1a25685
[09:39:42] fixed image digest: sha256:a263a1298e89e0bdf019005ce1927e9aadaa8f1bd2a94a3e66ad94e2a89e19ce
[09:39:42] [vuln-1] starting container (codeberg.org/forgejo/forgejo:16.0.3-rootless)
[09:39:52] [vuln-1] service healthy on 127.0.0.1:4011
[09:39:53] [vuln-1] admin user + token ready
[09:39:55] [vuln-1] malicious template pushed
[09:40:03] [vuln-1] generate API returned 201
[09:40:15] [vuln-1] marker=**** hook_id=**** hostdata=**** readme_ok=**** gen=201
[09:40:15] [vuln-2] starting container (codeberg.org/forgejo/forgejo:16.0.3-rootless)
[09:40:25] [vuln-2] service healthy on 127.0.0.1:4012
[09:40:26] [vuln-2] admin user + token ready
[09:40:28] [vuln-2] malicious template pushed
[09:40:32] [vuln-2] generate API returned 201
[09:40:36] [vuln-2] marker=**** hook_id=**** hostdata=**** readme_ok=**** gen=201
[09:40:36] [fixed-1] starting container (codeberg.org/forgejo/forgejo:16.0.4-rootless)
[09:40:40] [fixed-1] service healthy on 127.0.0.1:4111
[09:40:40] [fixed-1] admin user + token ready
[09:40:41] [fixed-1] malicious template pushed
[09:40:46] [fixed-1] generate API returned 201
[09:40:50] [fixed-1] marker=false hook_id=false hostdata=false readme_ok=**** gen=201
[09:40:50] [fixed-2] starting container (codeberg.org/forgejo/forgejo:16.0.4-rootless)
[09:40:52] [fixed-2] service healthy on 127.0.0.1:4112
[09:40:53] [fixed-2] admin user + token ready
[09:40:54] [fixed-2] malicious template pushed
[09:40:58] [fixed-2] generate API returned 201
[09:41:02] [fixed-2] marker=false hook_id=false hostdata=false readme_ok=**** gen=201
[09:41:02] vuln markers: **** / **** ; hook-id: **** / **** ; hostdata: **** / **** ; gen: 201 / 201
[09:41:02] fixed markers: false / false ; readme-ok: **** / **** ; gen: 201 / 201 runtime_manifest.json written with 44 proof artifacts
[09:41:02] VERDICT: CONFIRMED - remote code execution reproduced on Forgejo 16.0.3 via crafted template repository; fixed 16.0.4 unaffected
--- END REPRODUCTION OUTPUT ---
[pruva] ==========================================
[pruva] VERIFICATION SUCCESSFUL
[pruva] Duration: 93s
[pruva] ==========================================
[pruva] Logs: /workspaces/pruva-sandbox/pruva-results/REPRO- 2026-00345/logs/ - fixed-1 - fixed-2 - reproduction_steps.log - vuln-1 - vuln-2
[pruva] Results saved to: /workspaces/pruva-sandbox/pruva-results/REPRO-2026-00345
[pruva] Keeping work directory: /workspaces/pruva-sandbox/pruva-results/REPRO-2026-00345 Outcome: success User: vscode WorkspaceFolder: /workspaces/pruva-sandbox
0. https://codeberg.org/forgejo/forgejo/src/branch/forgejo/rele...
It would take a boatload of such events to equal the opex of GitHub hosting. That’s not an excuse to run amok, but it’s far from tipping the scales in GitHub’s cost favor.
It can't be done without authenticating first, but there's nothing about RCE that says that it must be sent from unauthenticated connection.
You should be OK, but if attacker takes over your user (or any user in your forgejo instance) they can execute code on the host server - as you said yourself. In other words, it allows them to achieve remote code execution, so it's a RCE.
This means you have no choice but to use AI to defend, find and patch these flaws before attackers quickly build and use these exploits to target users.
You cannot afford to disallow or have a 100% ban on LLM contributions while attackers do not care and will use AI to find the flaws and attack you faster than you can triage it.