A critical, unpatched remote code execution vulnerability in Gogs, a widely used self-hosted Git service, allows any authenticated user to execute OS commands with the privileges of the Gogs process user, potentially leading to full control of the host server. The attack is fully automated via a publicly available exploit tool, meaning the barrier to exploitation is low and active compromise attempts are likely. Organizations running Gogs for source code management face immediate risk of intellectual property theft, supply chain compromise, and full system takeover with no vendor patch available.