CVE-2026-73539: Gitea external renderer argument injection and code execution
Gitea substitutes a URL derived from the markup Context field into external renderer command templates without escaping the reference path before shell-style argument splitting. A crafted Context can inject additional renderer arguments, including options that load executable filter files. On deployments using a susceptible external renderer such as pandoc, a user who can place a filter file at an accessible path can cause it to execute as the Gitea service account; the public repository markup endpoint itself can be reachable without authentication.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to code execution?
Exposure requires Gitea to use a susceptible external renderer, such as pandoc. The attacker must be able to supply a crafted markup Context and place an executable filter file at a path accessible to the Gitea service account.
Is authentication required to trigger the vulnerable rendering path?
Not necessarily. The public repository markup endpoint can be reachable without authentication, so unauthenticated triggering may be possible where that endpoint is publicly accessible.
What account would execute the injected code?
Executable filter files run as the Gitea service account. The impact is therefore limited or expanded according to that account's filesystem access and operating-system privileges.