Mitigating PHP2Shell: Everything You Need to Know
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability, CVE-2026-73802, in gitea-runner arises from the improper handling of user-controlled jobs.<job>.container.options within workflow YAML. When the runner's privileged mode is disabled, the system fails to adequately filter or reject dangerous Docker flags related to host namespaces, capability expansion, and security profile overrides. The analysis identifies two key functions in the exploitation chain: gitea.com/gitea/runner.RunContext.options and gitea.com/gitea/runner.mergeContainerConfigs. The RunContext.options function is where the untrusted workflow options are appended to the runner's container configuration. Subsequently, mergeContainerConfigs takes these unsanitized options and directly parses them into the Docker HostConfig, effectively applying the malicious configurations. The description explicitly states that sanitizeConfig() only filters Binds and Mounts, highlighting the lack of sanitization for other critical options. Therefore, an attacker submitting a workflow with crafted container.options would trigger these functions, leading to the application of dangerous Docker settings and ultimately allowing them to break out of the container and execute commands as root on the runner host. These functions are the direct points where the vulnerability manifests and would appear in a runtime profiler during an exploit.
gitea.com/gitea/runner.RunContext.optionsunknown
gitea.com/gitea/runner.mergeContainerConfigsunknown
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| gitea.com/gitea/runner | go | < 1.0.9-0.20260731160927-34bfa1915022 | 1.0.9-0.20260731160927-34bfa1915022 |