{
  "id": "CVE-2026-60004",
  "vendor_project": "Gitea",
  "product": "Gitea",
  "description": "Gitea contains a code injection vulnerability that allows an attacker with repository write access to send a malicious patch to the diffpatch API endpoint to plant an executable Git hook and run shell commands as the Gitea service account.",
  "kev_date_added": "2026-08-25",
  "cvss": 9.0,
  "severity": "High",
  "advisories": [],
  "cited_in_cases": [],
  "indictment_cited": false
}