CVE-2026-73539: Gitea external renderer argument injection and code execution

Vulnerability summary

CVE-2026-73539 is a high (CVSS 7.5) Argument Injection vulnerability in gitea. EPSS estimates a 0.47% chance of exploitation in the next 30 days, higher than 40% of scored vulnerabilities.

Timeline

1. 14-10-2026
   PublishedVulnerability first disclosed.
2. 18-10-2026
   Last modifiedVulnerability information updated.

Description

Gitea substitutes a URL derived from the markup Context field into external renderer command templates without escaping the reference path before shell-style argument splitting. A crafted Context can inject additional renderer arguments, including options that load executable filter files. On deployments using a susceptible external renderer such as pandoc, a user who can place a filter file at an accessible path can cause it to execute as the Gitea service account; the public repository markup endpoint itself can be reachable without authentication.

• CWE-88Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.