1. Critical security vulnerability in Forgejo’s template expansion
Multiple commenters reiterated the details of the CVE‑style flaw: a malicious template repository could inject a .git folder during variable expansion, leading to arbitrary file read and remote code execution on the Forgejo host. The fix removes any .git folder after expansion before initializing the new repo.
“A malicious template repository could be used to read arbitrary data from the Forgejo host, and to execute arbitrary processes on the Forgejo host, as a remote code execution attack. To address this issue, after variable expansion is completed, any existing
.gitfolder is removed from the directory before the git repository is initialized.” – Macha (quoting the PR)
2. Debate over LLM‑generated code and its role in security
A sizable sub‑thread discussed Forgejo/Codeberg’s policy disallowing projects that are “majority LLM‑written,” with users arguing whether LLMs can help find bugs or merely add noise. Opinions ranged from skepticism about LLM usefulness to advocacy for using LLMs as a first‑pass scanner followed by manual review.
“You can. People on Codeberg use LLMs. They are just against spam of low quality projects generated with LLMs.” – omnimus
“They may not use AI to check for vulnerabilities … you didn’t read the comment, did you?” – 1matin
3. Mitigation strategies and platform‑specific observations
Commenters advised practical steps for self‑hosted Forgejo instances (e.g., turning off open registration, avoiding untrusted template repos) and noted that Gitea appears unaffected by the same bugs, while some experienced Codeberg rate‑limit errors when trying to view the release notes.
“It looks like this is a bit less concerning if you have turned off open account registration.” – hephaes7us
“Gitea is protected against both of these issues.” – techknowlogick
“Since the release notes is currently unreadable due to codeberg rate limits …” – Macha