Works with the AI tools you already use

    Claude CodeClaude CodeCursorCursorCodex CLICodex CLIGitHub CopilotGitHub CopilotGemini CLIGemini CLI+20 more

    gitea ci injection

    1

    Identify and exploit Gitea Actions CI/CD vulnerabilities, including auth bypasses and rogue runner registration.

    $5

    Secure checkout via Stripe

    30-day refund guarantee

    Converts to your local currency at checkout

    0 installsSecurity scanned
    gitea ci injection

    gitea ci injection

    Example session with this skill installed

    Target Gitea instance at gitea.internal is version 1.25.0. I have read access. Check for CI injection vulnerabilities and provide an exploit path for the runner host.

    • Read your context and instructions
    • Compiled the gitea ci injection

    I have analyzed the target Gitea instance. The version (1.25.0) is vulnerable to

    CVE-2026-26231 (PR Auth Bypass) and lacks protection against rogue runner registration.

    Gitea CI Exploit Analysis

    VectorStatusRequirements
    CVE-2026-26231VulnerableGitea <= 1.26.1, Git HTTP/SSH access
    npm preinstallPotentialnpm ci or npm install in .gitea/workflows
    Self-Registered RunnerHighly LikelyUser-level registration tokens enabled
    SSSD Auth BypassActiveSPNEGO available for token generation

    Exploit Path: Rogue Runner Registration

    Since fork-side on: push workflows queue indefinitely on upstream runners, use the self-registration vector to execute code as the runner service account.

    1. Get Registration Token:
    curl --negotiate -u : http://gitea.internal/api/v1/user/actions/runners/registration-token
    1. Register Host Executor:
      Deploy act_runner to the host and register with a host label to bypass Docker requirements:
    ./act_runner register --instance http://gitea.internal --token <TOKEN> --labels ubuntu:host:// --no-interactive
    1. Trigger Execution:
      Push a workflow to your fork. The rogue runner will claim the job, executing your payload directly on the host OS.

    Next steps

    • Verify if port 22 or 2222 is open for the CVE-2026-26231 push bypass.
    • Check .gitea/workflows in the target repo for npm command triggers.
    • Download the act_runner binary for linux-amd64 to prepare for host registration.

    Connects securely to your tools. The creator never sees your data.

    What you get

    Bypass repo write restrictions using reverse-fork pull requests.Execute arbitrary code on runners via npm preinstall scripts.Hijack queued jobs by registering rogue user-level act_runners.Audit Gitea instances for known CVEs and auth configuration flaws.

    About this skill

    The problem

    Gitea Actions environments often lack strict isolation between fork workflows and upstream runners. Developers and security auditors need to identify how authenticated users with read-only access can escalate privileges through CI/CD pipelines.

    What it does

    • Identifies and exploits CVE-2026-26231 to bypass write checks via reverse-fork PRs.
    • Injects malicious preinstall scripts into package.json to capture runner host sessions.
    • Circumvents SSSD/LDAP basic auth failures (HTTP 500) using SPNEGO-capable API endpoints.
    • Registers rogue user-level act_runner instances to hijack queued fork workflows.
    • Automates version detection for Gitea CVEs including 2026-27780 and 2026-26292.

    Frameworks & tools

    Gitea Actions, act_runner, Git HTTP/SSH, npm/Node.js, and SSSD/LDAP authentication backends.

    Why this beats prompting it yourself

    Standard LLMs struggle with the specific sequence of API calls needed for Gitea reverse-fork PR binding. This skill handles the nuances of runner scoping and provides verified workarounds for common SSSD authentication failures that stall basic exploit attempts.

    Use cases

    • Perform authorized red team assessments on Gitea-based internal CI/CD infra.
    • Audit Gitea runner registration policies for unauthorized user-level tokens.
    • Test pipeline resilience against malicious npm lifecycle scripts in PRs.

    Known limitations

    Requires a Gitea account with at least read access to the target repository. The CVE bypass applies to Git protocol pushes, not API content updates.

    How to install

    Works the same in every agent - Claude, Cursor, Codex, Copilot and 20+ more.

    ~30 seconds
    1. 1

      Download the ZIP

      Free skills download straight away. Paid skills unlock right after purchase.

    2. 2

      Unzip into your skills folder

      Every agent reads skills from one folder on your machine. Drop the unzipped folder in there.

    3. 3

      Ask your agent to use it

      Restart the agent if it was already running. It picks the skill up automatically - no config needed.

    Skills folder by agent

    Click the path to copy it. Create the folder if it does not exist yet.

    Reviews

    No reviews yet

    Be one of the first to try it. Every listed skill passes our trust checks below.

    Security scanned

    Passed our 8-point scan before listing

    Fresh listing

    Recently published to Agensi

    30-day refund

    Not a fit? Get your money back

    Trust & safety

    Security scanned

    Verified clean 7 days ago

    • Passed all security checks, Safe to install

    Listed7 days ago

    What's inside

    Frequently Asked Questions