CVE-2024-39930 is a critical argument injection vulnerability in the built-in SSH server of Gogs, allowing authenticated users to execute arbitrary commands on the host.
Versions through 0.13.0 are affected; Windows installations are not. Gogs fixed the flaw in version 0.13.1.
A public proof-of-concept exploit exists per CISA.