No fix yet for critical RCE bug in open-source Git service Gogs - exploit module is out
(www.theregister.com)
I didn't realise that people still use Gogs. It was forked to Gitea, which was then forked to Forgejo. Forgejo has a much larger focus on security compared to its predecessors.