A critical remote code execution (RCE) vulnerability has been identified in Gogs, an open source self-hosted Git service. Affected versions are prior to 0.14.3. The vulnerability arises when authenticated users create a pull request with a specially crafted branch name that injects the --exec flag into the git rebase command during the 'Rebase before merging' merge operation. This allows attackers to execute arbitrary code on the server with the privileges of the Gogs service account. The CVSS score of 9.9 indicates a critical severity level, posing a high risk to systems utilizing vulnerable versions. Organizations running Gogs instances should immediately upgrade to version 0.14.3 or later to mitigate this risk. No workaround is available aside from applying the official patch. Users are advised to review their access controls and monitor for unauthorized activities until the update is applied.