{"vulnerability": "CVE-2026-89094", "sightings": [{"uuid": "5260eef8-373e-4e50-afc4-7ed5dd34897b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-89094", "type": "seen", "source": "https://infosec.exchange/users/cR0w/statuses/117248919367381106", "content": "RE: https://infosec.exchange/@cR0w/117247864965166656\nCVE for this one:\nhttps://nvd.nist.gov/vuln/detail/cve-2026-89094\nsev:CRIT 9.9 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\n\nForgejo before 16.0.4 allows remote code execution via a crafted template repository because template expansion on files in .forgejo/template is mishandled.", "creation_timestamp": "2026-09-10T21:42:16.203278Z"}, {"uuid": "4eb16d7a-43ef-408d-90b7-4ae2a22a1a68", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89094", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mv72urrr3j2t", "content": "\ud83d\udea8 CVE-2026-89094 \u2014 CVSS 9.9 CRITICAL\n\nForgejo before 16.0.4 allows remote code execution via a crafted template repository because template expan...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-89094\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-10T22:08:35.001974Z"}, {"uuid": "172c62e4-df7d-4e26-92f2-5cdfc09748be", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89094", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mv73jfjrip25", "content": "CVE-2026-89094 - forgejo\nIf you use Forgejo version earlier than 16.0.4 and allow template repositories, a specially crafted template can cause the server to execute unwanted code. This could let an attacker take\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#forgejo #CVE #infosec", "creation_timestamp": "2026-09-10T22:20:07.120199Z"}, {"uuid": "45a22d80-fb35-427b-ab1b-b7dd395b81f6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89094", "type": "seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mvan76bnav2t", "content": "A critical Forgejo remote code execution flaw, tracked as CVE-2026-89094, threatens Git servers. Patch this Forgejo remote code execution bug today.\n\n#Forgejo #RemoteCodeExecution #CVE202689094 #Cybersecurity #DevSecOps", "creation_timestamp": "2026-09-11T13:09:11.596883Z"}, {"uuid": "4de0d781-24b6-4f81-998c-a9a8be95f655", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89094", "type": "seen", "source": "https://infosec.exchange/users/DarkWebInformer/statuses/117254565022613737", "content": "\ud83d\udea8 CVE-2026-89094: Forgejo before 16.0.4 allows remote code execution via a crafted template repository because template expansion on files in .forgejo/template is mishandled.\nCVSS: 9.9\nForegejo Update/Notes: https://codeberg.org/forgejo/forgejo/src/branch/forgejo/release-notes-published/16.0.4.md", "creation_timestamp": "2026-09-11T21:37:55.173151Z"}, {"uuid": "4879a935-29a3-4f57-a600-836686b325cf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-89094", "type": "seen", "source": "https://bsky.app/profile/0daynews.bsky.social/post/3mvgu6tki6r2g", "content": "Forgejo 16.0.4 patches CVE-2026-89094, a CVSS 9.9 RCE via crafted template repositories. No workaround exists \u2014 upgrade now. #infosec https://0daynews.com/articles/2026-09-12-forgejo-cve-2026-89094-template-rce/?utm_source=bluesky&utm_medium=organic_social&utm_campaign=always_on&utm_content=hub-1929", "creation_timestamp": "2026-09-14T00:30:14.894145Z"}]}