Gitlab
Monthly
Multiple out-of-bounds read and write defects in the X.Org X client libraries (libX11, libXi, libXpm, libXrender, libXtst) let a malicious or compromised X server send crafted replies that drive client-side parsers past the end of the received buffer, crashing the linked application and, in the libX11 XKB case, writing past an allocated array. Affected are libX11 before 1.8.14, libXi before 1.8.4, libXpm before 3.5.20, libXrender before 0.9.13 and libXtst before 1.2.6; exploitation requires the victim's client to connect to an untrusted server and, per the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H (6.5), the craftwork is unauthenticated but needs user interaction, with demonstrated impact limited to denial of service rather than code execution. No CVSS vector, EPSS score, KEV entry or POC indicator was supplied for CVE-2026-109090 specifically, so no public exploit identified at time of analysis and quantitative exploitation signals are absent.
Out-of-bounds reads and writes in the X.Org X client libraries (libX11, libXi, libXpm, libXrender and libXtst) can be triggered when a connecting X11 client parses crafted replies or events returned by a malicious, compromised, or man-in-the-middled X server, causing client crashes and, in a subset of cases, limited memory disclosure. The lead issue in the advisory is an out-of-bounds write in libX11's XKB action parser when a XkbGetMap reply contains keycode values above max_keycode + 1; the family also includes multiple out-of-bounds reads in libXi's XI2 class parsing and XQueryDeviceState/XListInputDevices replies, all of which are fixed in libX11 1.8.14, libXi 1.8.4, libXpm 3.5.20, libXrender 0.9.13 and libXtst 1.2.6. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, 6.5) indicates exploitation is unauthenticated but requires user interaction, with impact limited to denial of service rather than confirmed code execution; no public exploit identified at time of analysis, and no KEV entry or EPSS score was supplied.
Out-of-bounds reads in the X.Org X client libraries - libXrender before 0.9.13 and libXtst before 1.2.6 in the parsing paths covered by this entry, alongside the sibling fixes shipped in libX11 1.8.14, libXi 1.8.4 and libXpm 3.5.20 - let a malicious or compromised X server crash connecting clients by returning malformed protocol replies. The clients trust length, count and category fields supplied by the server (for example the depth, visual and subpixel counts used when building XRenderInfo, and the datum/category handling in libXtst's XRecord reply parser) without validating them against the actual received buffer, so parsing walks past the end of the packet and causes a denial of service. Per the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H (6.5), the attacker is unauthenticated from the network but exploitation requires user interaction - the victim must launch or connect an affected client to the hostile server (for example via ssh -X/-Y X11 forwarding to a compromised display) - and there is no public exploit identified at time of analysis.
Cache poisoning of raw repository file responses in GitLab CE/EE (all versions before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2) lets a low-privileged authenticated user supply crafted repository references so that cached raw-file content is served to other users. When a targeted victim's CI/CD pipeline subsequently fetches that poisoned raw file, the pipeline executes attacker-controlled content, potentially exposing protected environment variables. Publicly available exploit code exists (referenced via a HackerOne report), but the issue is not confirmed as actively exploited (no CISA KEV listing); exploitation is rated high complexity (AC:H), requires authentication (PR:L), and success depends on a victim pipeline actually pulling and running the poisoned content, making this a credible, high-priority issue rather than an emergency.
An authenticated user holding only the Developer role can run CI/CD pipelines on protected branches in GitLab CE/EE without authorization, because the downstream (multi-project/child) pipeline creation service failed to enforce proper permission checks (CWE-863). All versions from 18.7 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 are affected, and exploitation is conditional: it requires a valid Developer account plus projects that combine downstream pipelines with protected-branch restrictions, which is why the independent assessment raises attack complexity to High even though the vendor rates the issue 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N). Publicly available exploit code exists in the form of a HackerOne report, but the provided data contains no confirmation of active exploitation and no KEV listing. Integrity impact is the dominant risk: unauthorized pipeline execution on a protected branch can inject or alter build, test, and deployment artifacts that the branch protection model was designed to shield.
Improper cleanup of scheduled pipeline execution policy records in GitLab Enterprise Edition lets an authenticated user execute arbitrary CI/CD pipelines in a transferred project using the destination group's privileges. Affected releases are all EE versions from 18.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2. Exploitation is conditional - the attacker needs a valid account, a project that has a configured scheduled pipeline execution policy, the project-transfer workflow, and user interaction (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N, 7.7) - but publicly available exploit code exists per the referenced HackerOne report, and no CISA KEV entry has been recorded, so this is a moderate, conditional privilege-escalation risk rather than a mass-exploitation emergency.
Stored cross-site scripting in GitLab CE/EE (affected ranges 19.1 through 19.2.7, 19.3 through 19.3.4, and 19.4 through 19.4.1) lets an authenticated user with repository write access embed a crafted file whose syntax-highlighted output is rendered with unsanitized HTML attributes, executing arbitrary JavaScript in the browser session of any other user who views it. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N reflects that the attacker must be authenticated (PR:L) and that a second user must render the malicious content (UI:R), but that successful execution crosses a trust boundary (S:C) with high confidentiality and integrity impact, including potential theft of session tokens or actions taken as the victim. Exploitation requires publicly available exploit code exists, with a HackerOne report and the upstream work item publicly linked; CISA KEV status was not indicated in the supplied intelligence, so this should be treated as a high-priority authenticated stored XSS rather than a confirmed actively exploited campaign. The affected surface is bounded by the requirement for repository control plus a victim viewing the highlighted file, so unauthenticated or pure drive-by exploitation is not possible.
Remote code execution in GitLab CE/EE (all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2) allows an unauthenticated attacker to execute arbitrary code on the GitLab server by supplying a specially crafted regular expression in a CI/CD configuration that passes insufficient regex validation; the defect is tracked as CWE-190 (integer overflow) and the vendor scores it 10.0 with scope change (S:C). Publicly available exploit code exists, referenced through HackerOne reports cited in the CVE record, but there is no CISA KEV entry and no confirmed active exploitation at time of analysis. Our independent assessment retains the same impact (C:H/I:H/A:H) but raises attack complexity to AC:H, because the vendor states the regex-validation path is reached by an unauthenticated user only 'under certain conditions' that are not detailed publicly and should be confirmed with GitLab; patched instances (19.4.2, 19.3.5, 19.2.8 or later) are not affected.
Authenticated users of GitLab Enterprise Edition can inject specially crafted content into the context that AI agent features assemble, allowing unintended commands to be executed and attributed to other users. The issue affects GitLab EE from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2, and exploitation requires a valid EE account (PR:L), the AI agent/conversation feature to be enabled and in use, and a separate victim user to trigger the affected AI interaction (UI:R), so realistic exposure is substantially narrowed despite the network attack vector. No public exploit code or confirmed active exploitation was identified at time of analysis; vendor-released patches are available in versions 19.2.8, 19.3.5, and 19.4.2.
A use-after-free in the XInput2 passive grab handling of X.Org X server builds prior to xorg-server-21.1.25 and Xwayland prior to xwayland-24.1.14 allows an authenticated client that can add and remove XI2 master devices to crash the server or potentially achieve arbitrary code execution. The attacker creates a passive grab whose modifierDevice points at a master device, then calls XIRemoveMaster to free that device; the grab retains a dangling DeviceIntPtr that later input processing dereferences, corrupting the heap. Reaching the vulnerable code requires a valid client connection to the X server or Xwayland (typically local, since modern X servers do not listen on TCP by default) and the XI2 extension, which is enabled by default; no public exploit code and no CISA KEV entry have been identified at time of analysis.
Heap-based buffer overflow in X.Org X server and Xwayland's glamor acceleration backend (glamor_upload_boxes) allows an authenticated local X client to cause memory corruption, potentially leading to arbitrary code execution or denial of service. The flaw occurs when a 24-bit drawable is used with a 32-bit pixmap and crafted dimensions trigger an integer overflow in size calculation, affecting X.Org X server versions prior to 21.1.25 and Xwayland versions prior to 24.1.14. No public exploit code or active exploitation has been identified at time of analysis, but the vulnerability requires a local authenticated connection and glamor hardware acceleration to be enabled.
Heap-based buffer overflow in X.Org X server and Xwayland GLX RenderLarge request handling allows an authenticated local X client to write past the allocated heap buffer, potentially achieving arbitrary code execution or causing denial of service. Affected versions are xorg-server prior to 21.1.25 and Xwayland prior to 24.1.14; the attacker must already be able to open an X display with GLX available, which by default means local Unix-socket access rather than remote unauthenticated access. No public exploit identified at time of analysis.
Use-after-free in the Present extension of X.Org X server before 21.1.25 and Xwayland before 24.1.14 lets an authenticated X client crash the display server and potentially expose limited process memory. An attacker with the ability to open an X display connection creates cross-window Present notify entries pointing at a separate target window and then destroys that window, so the freed per-window notify list is traversed after present_clear_window_notifies() releases the window's private data without unlinking the entries; both the Present and SYNC extensions must be enabled, which they are by default. The issue is a local, low-privilege, user-interaction-free memory-safety bug (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H), and no CISA KEV listing, EPSS score, or public exploit code was identified at time of analysis.
A double free in the X.Org X server's XKB SetGeometry request handler (CVE-2026-88812) lets an authenticated X client that is already able to connect to the target display corrupt heap memory by sending a crafted XkbSetGeometry request containing a malformed TextDoodad entry, with outcomes ranging from a server crash to potential arbitrary code execution. Only builds of xorg-server prior to 21.1.25 and Xwayland prior to 24.1.14 are affected, and the XKB extension required for the trigger is standard and enabled by default. The assessed vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning exploitation presupposes an existing local/same-session X connection rather than remote or unauthenticated access, and no public exploit code, EPSS score, or CISA KEV entry appears in the supplied data, so reliable code execution additionally depends on defeating heap allocator hardening.
Multiple memory-safety defects in X.Org X server prior to xorg-server-21.1.25 and Xwayland prior to xwayland-24.1.14 let an authenticated X client corrupt server heap and stack memory through crafted XKB, Present, XInput2, GLX and XFixes protocol requests, causing crashes or potentially arbitrary code execution inside the X server process. The flaws include a double free in XKB SetGeometry TextDoodad handling, use-after-frees in the Present cross-window notify path and in XInput passive grabs after XIRemoveMaster, heap overflows in GLX RenderLarge and XkbResizeKeyType, an XFixes pointer-barrier event buffer overflow, and an incomplete-fix out-of-bounds write in the XKB ChangeKeycodeRange path. Exploitation requires a connection already authorized to the X server (typically a local user session, an X11-forwarded session, or a multi-seat/shared-display host); no public exploit code and no confirmed in-the-wild exploitation have been identified at time of analysis, and the assessed vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Pure-Wayland deployments that do not run Xwayland are not exposed.
Heap buffer overflow in X.Org X Server versions prior to 21.1.25 and in Xwayland prior to 24.1.14 stems from an integer truncation inside XkbResizeKeyType(), where the computed key-symbol count is stored in an unsigned short and wraps for sufficiently large nTotal values, yielding an undersized allocation that subsequent writes overflow. The X.Org advisory of October 2026 states the trigger is an X client sending crafted XKB requests that resize a key type with a large nTotal; because no CVSS vector was supplied, authentication requirements are not confirmed from available data, and the advisory's own phrasing describes the actor as an authenticated X client. No CVSS score, EPSS estimate, CISA KEV listing, or public exploit code was available at time of analysis, so no public exploit identified at time of analysis; the vendor assesses the impact as heap corruption that can lead to arbitrary code execution or denial of service. This CVE is one of seven flaws disclosed together in the same X.Org security advisory.
Heap out-of-bounds write in the X.Org X server (versions prior to xorg-server-21.1.25) and Xwayland (versions prior to xwayland-24.1.14) allows an authenticated X client to corrupt heap memory by issuing an XkbChangeKeycodeRange request that sets a keycode range where MAP_LENGTH exceeds max_key_code+1, leaving XkbAllocNames under-allocated while the subsequent memset writes MAP_LENGTH bytes. The flaw is an incomplete fix of an earlier XKB keycode-range change (commit a3171732d) and is scored locally as CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning the attacker must already hold an authorized X connection - a local session, a compromised GUI application on the same display, or a forwarded X session - rather than merely reaching the host over the network. No CVSS vector, EPSS score, KEV listing, or public exploit code is present in the supplied data, so this analysis rests solely on the X.Org advisory text and no public exploit has been identified at time of analysis; the same October 7, 2026 advisory bundles six further memory-safety issues (CVE-2026-88812, -93515, -93516, -93517, -93518, -93519) fixed in the same releases.
Buffer overflow in X.Org X Server's XFixes extension (and Xwayland) allows an authenticated local X client to trigger a stack or heap overflow by creating more than 100 pointer barriers and generating pointer motion events, potentially leading to arbitrary code execution or denial of service. The flaw, tracked as CVE-2026-93519, affects X.Org X server versions prior to 21.1.25 and Xwayland versions prior to 24.1.14. No public exploit code or active exploitation has been identified at time of analysis; independent assessment assigns a CVSS 3.1 vector of AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Heap buffer overflow in the glamor acceleration path of the X.Org X server (and Xwayland) allows an authenticated local X client to corrupt the server's heap, with the potential for code execution or a server crash, although reliable exploitation is assessed as high-complexity. The flaw is addressed in the October 2026 X.Org security release, which fixes a bundle of XKB, Present, XInput, GLX and XFixes issues in xorg-server 21.1.25 and xwayland 24.1.14. No public exploit code and no CISA KEV entry were identified at time of analysis; no CVSS vector or EPSS score was supplied for this CVE, and the input itself does not contain a CVE-2026-93523 advisory entry, so the mapping of this identifier to the glamor size-calculation overflow is inferred from an associated upstream commit rather than confirmed by vendor text.
Heap memory corruption in the X.Org X server (prior to 21.1.25) and Xwayland (prior to 24.1.14) arises from a cluster of flaws disclosed in the October 2026 X.Org security advisory, for which CVE-2026-93524 serves as the coordinating identifier. An authenticated local X client that can already open and authenticate to the display socket can trigger double-free, use-after-free, numeric-truncation and heap buffer overflow conditions across the XKB, Present, XInput, GLX and XFixes extensions, causing server crashes and - where heap layout protections are defeated - potentially arbitrary code execution. The assessed vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H; no public exploit code, EPSS score or CISA KEV listing was present in the source data, so no public exploit is identified at time of analysis, and the advisory text does not state the specific trigger conditions for CVE-2026-93524 itself.
Account takeover in Plane (makeplane) versions prior to 1.4.0 allows remote unauthenticated attackers to log in as existing users by exploiting OAuth email trust in Gitea and self-managed GitLab deployments where email confirmation is disabled. The vulnerability (CWE-287) stems from Plane matching the email returned by the OAuth provider to a local account without verifying provider-side ownership; an attacker can set an OAuth identity's unverified email to the victim's address and authenticate as them without knowing the password, as confirmed by the provided independent assessment. Deployments using GitHub, GitLab.com, or Google OAuth are not affected because those providers return verified emails; no public exploit identified at time of analysis, and the flaw is gated by deployment configuration rather than being universally exploitable.
Remote command execution on the GitLab AI Gateway is achievable by an authenticated user who has been granted Duo Agent Platform access, by supplying a specially crafted flow configuration whose prompt template escapes the intended sandbox (CVE-2026-90970). The flaw is a server-side template injection (CWE-1336) rated CVSS 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), meaning a single low-privileged authenticated account yields high confidentiality, integrity, and availability impact that extends beyond the vulnerable component's own security scope. Affected deployments are AI Gateway versions 18.1.6 up to but not including 19.2.4, 19.3 before 19.3.2, and 19.4 before 19.4.1; GitLab has remediated the issue and no public exploit identified at time of analysis, though the requirement for Duo Agent Platform to be enabled and for the attacker to hold a legitimate authenticated account with access to it materially narrows the exposed population.
Stored cross-site scripting in GitLab CE/EE lets an authenticated user who can create or modify a merge request embed crafted content in a path component that the merge request diff viewer fails to sanitize, so arbitrary JavaScript executes in the browser session of any other user who views that diff. All versions from 13.11 up to the fixed releases 19.2.7, 19.3.3 and 19.4.1 are affected; the CVSS 3.1 base score is 8.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N), reflecting network reachability, low privileges required, mandatory victim interaction, and a scope change because the attacker compromises a different user's session rather than their own. Publicly available exploit code exists - the issue was disclosed through GitLab's HackerOne program - but there is no evidence of confirmed active exploitation (CISA KEV) at time of analysis.
Authenticated users who can define or modify a CI/CD configuration can achieve remote code execution on GitLab CE/EE servers by submitting a specially crafted regular expression that triggers a double free during server-side parsing. All versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 are affected; the vendor scores the issue 9.9, while our assessment retains full confidentiality and integrity impact but raises attack complexity to high because the vulnerable path is state-dependent and double-free corruption is inherently unreliable to exploit. Publicly available exploit code exists (a HackerOne report is referenced), and patches are available in 19.2.7, 19.3.3, and 19.4.1; there is no CISA KEV confirmation of active exploitation.
An authenticated GitLab EE user can read sensitive CI/CD variable values from debug-mode job traces via the Duo AI troubleshooting feature because of a missing authorization check (CWE-862). Affected versions are GitLab EE 18.7 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1. Exploitation is gated behind authentication and requires the non-default combination of CI_DEBUG_TRACE debug tracing and the Duo AI feature, and no public exploit code has been identified at time of analysis; this is a moderate-priority issue rather than a critical one.
Authenticated code execution on the GitLab server is possible in GitLab CE/EE 19.2 through 19.4.0, where an integer overflow triggered while compiling a specially crafted regular expression in a CI/CD configuration can be leveraged to run arbitrary code with the privileges of the GitLab application. The attacker must hold a GitLab account with enough project privileges to create or modify CI/CD configuration (typically Developer or higher on a project), and exploitation only occurs 'under certain conditions,' so it is not universally triggerable; the vendor-assessed vector is PR:L with scope change, and our independent assessment raises attack complexity to High (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H). Publicly available exploit code exists - a HackerOne report accompanies the fix - but there is no confirmed active exploitation (no CISA KEV listing), and instances already on 19.2.7, 19.3.3, or 19.4.1 or later are not exposed.
Dokploy instances running versions prior to 0.29.13 disclose stored Git provider secrets - GitHub App private keys, OAuth tokens and client secrets, webhook secrets, and Gitea/Bitbucket access tokens, refresh tokens, and app passwords - to authenticated organization members who were never granted access to those providers. The protected tRPC procedures github.one, gitlab.one, gitea.one, and bitbucket.one return full provider rows without applying getAccessibleGitProviderIds or an organization check, and application.one returns the same secrets as nested relations from findApplicationById even when hasGitProviderAccess is false. Exploitation requires an authenticated Dokploy account (PR:L) holding application read access or knowledge of a provider identifier, and the practical impact is confidentiality: a restricted member can use the leaked credentials to read private repositories or manipulate external CI/CD and webhook workflows. No public exploit code has been identified at time of analysis.
Unauthenticated denial of service in GitLab CE/EE (all versions from 18.4.6 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2) allows a remote attacker with no credentials to exhaust server resources through the GraphQL API by submitting queries whose true cost the complexity calculation under-counts. The flaw is an improper resource-allocation limit (CWE-770), scored CVSS 7.5 with the entire impact on availability (A:H) and none on confidentiality or integrity. Publicly available exploit code exists - a HackerOne report is linked from the advisory - but there is no CISA KEV listing, so active in-the-wild exploitation is not confirmed; EPSS data was not supplied with this record.
Insufficient scope validation in GitLab Enterprise Edition lets an authenticated user holding only Developer permissions run security policy test pipelines inside projects in their own group and read protected CI/CD variables that are meant to be restricted to Maintainer or Owner roles. All EE releases from 19.0 up to 19.1.8, 19.2.6 and 19.3.2 are affected, and GitLab shipped fixes in those patch releases. Publicly available exploit code exists (a HackerOne report is referenced), but there is no confirmed active exploitation and no CISA KEV listing.
Unauthenticated path traversal in the @zereight/mcp-gitlab Model Context Protocol server prior to version 2.1.27 allows any network-reachable attacker to read arbitrary files from the server host and exfiltrate their contents into an attacker-accessible GitLab project upload, enabling theft of the server's GITLAB_PERSONAL_ACCESS_TOKEN from /proc/self/environ and resulting in full GitLab account takeover. The exposure exists in SSE transport mode (SSE=true), which the advisory states is the default configuration for Docker deployments and which serves all MCP tools without any authentication; the assessed severity is CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). No public exploit code and no CISA KEV entry were identified at time of analysis, but the attack requires only network access to the exposed SSE port and a single call to the upload_markdown tool.
DNS rebinding against the local Streamable HTTP MCP listener in @zereight/mcp-gitlab before 2.1.30 lets a malicious web page reach a victim's loopback MCP endpoint while preserving an attacker-controlled Host and Origin, so the request is accepted at the HTTP boundary and reaches the MCP initialization path - and, where a GitLab token is configured, can drive GitLab API tool calls through the victim's browser. Exploitation is network-reachable with no attacker credentials required (CVSS PR:N) but hinges on victim interaction (UI:R): the user must browse to an attacker-controlled page while an unpatched server listens on its default 127.0.0.1 bind with no effective Host/Origin allowlist. Publicly available exploit code exists - the vendor advisory ships a proof-of-concept reproduction - and the upstream/NVD vector scores 9.6 Critical, while the independent assessment lowers availability impact to Low (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L); in REMOTE_AUTHORIZATION=true deployments, token checks block material unauthenticated GitLab API tool calls, reducing realized impact to the HTTP-boundary/initialization failure.
Server-side request forgery in the @zereight/mcp-gitlab Model Context Protocol server (npm versions 0.0.1 through 2.1.26) allows a caller who can reach the server's HTTP/SSE transport to redirect every outbound GitLab API call to an attacker-controlled host - taking the victim's Private-Token with it - by setting a crafted X-GitLab-API-URL request header. The server accepts that header only when the non-default environment variable ENABLE_DYNAMIC_API_URL=true is set, and it validates the value with a syntax-only new URL() check, applying no allowlist or hostname restriction before the token is attached to the redirected fetch. Publicly available exploit code exists, the flaw is credibly rated as a high-impact credential-theft issue (assessed CVSS 3.1 base of 9.6 with scope change, C:H/I:H), and a vendor fix is available in version 2.1.27, so exposure is limited to deployments that have enabled the dynamic-API-URL option and exposed the transport beyond localhost.
Authenticated users of GitLab CE/EE can read CI/CD variables that are scoped to environments they are not entitled to, because the environment scope pattern matcher fails to validate scope input correctly. The flaw affects all versions from 15.7 up to 19.1.7, 19.2.5, and 19.3.1, with fixes in 19.1.8, 19.2.6, and 19.3.2. Public exploit code exists (referenced via a HackerOne report), the issue carries a CVSS of 7.7 with a confidentiality-only, scope-changed profile, and there is no CISA KEV listing indicating confirmed active exploitation at time of analysis.
Authenticated remote code execution in GitLab Enterprise Edition (Advanced Search / Elasticsearch indexing) allows a user with project-import rights to overflow a Unicode conversion buffer by importing a specially crafted Git project export, resulting in arbitrary command execution on the GitLab server. All EE versions from 12.3 through 19.1.8, plus 19.2 before 19.2.6 and 19.3 before 19.3.2, are affected under configurations where Advanced Search is enabled. Publicly available exploit code exists and the HackerOne report is referenced, making this a high-priority patching target for internet- or partner-exposed GitLab EE instances, though exploitation requires an authenticated account and a non-default Elasticsearch-backed search configuration.
Unauthenticated arbitrary file read in GitLab CE/EE lets remote attackers retrieve files from the GitLab server via the repository commits API, which fails to confine paths and does not enforce authentication. All 18.7 releases through 19.3.2 are affected across the fix lines (before 19.1.8, 19.2.6, and 19.3.2). This is confirmed actively exploited (CISA KEV) and publicly available exploit code exists, making it an emergency-patch priority for any internet-reachable GitLab instance.
Sensitive credential and configuration disclosure in GitLab Enterprise Edition allows an authenticated user with Duo Chat access to exfiltrate Advanced Search (Elasticsearch) instance configurations and stored credentials by supplying a specially crafted GraphQL subscription argument that bypasses serialization and forces an internal server object lookup. It affects EE 18.3 through 19.1.8, 19.2 through 19.2.6, and 19.3 through 19.3.2, was reported by GitLab, and publicly available exploit code exists (HackerOne #4012289). No CISA KEV listing at time of analysis, so this is POC-backed but not confirmed as actively exploited.
Credential exfiltration in Renovate before 44.11.3 lets a malicious or compromised GitLab server steal the authentication tokens Renovate uses to talk to it. When Renovate follows GitLab API pagination, it trusts the server-supplied Link header without validating its destination, so an attacker-controlled server can redirect the credential-bearing follow-up request to attacker infrastructure (CWE-601 open redirect). Reported by VulnCheck with a CVSS 4.0 base score of 9.2; no public exploit identified at time of analysis and no CISA KEV listing.
Server-Side Request Forgery in Gitingest through 0.3.1 allows unauthenticated attackers to redirect outbound server connections to arbitrary attacker-controlled hosts by exploiting a prefix-only hostname validation bypass in the `_validate_host` function. Because Gitingest may carry GitHub personal access tokens as HTTP basic auth credentials on outbound git requests, any host whose name begins with `git.`, `gitlab.`, or `github.` passes validation and becomes a credential harvesting endpoint. No public exploit code is confirmed at time of analysis and no CISA KEV listing exists, but the CVSS 4.0 score of 8.3 reflects the combination of low attack complexity, unauthenticated access, and high confidentiality impact.
Server-side request forgery in the GitLab AI Gateway (Duo Agent Platform) lets an authenticated user redirect outbound model requests to an attacker-controlled endpoint by supplying a crafted inline flow configuration that overrides the HTTP Host header, exfiltrating Google Cloud Vertex service credentials and private signing keys. It affects AI Gateway 18.10 through 19.0.11, 19.1 through 19.1.6, and 19.2 through 19.2.1. Publicly available exploit code exists (HackerOne #3945100); EPSS is low at 0.19% and it is not in CISA KEV.
Server-Side Request Forgery (SSRF) in GitLab AI Gateway allows authenticated users with Duo Agent Platform access to exfiltrate Google Vertex AI or AWS Bedrock cloud service credentials by injecting a malicious endpoint into crafted model metadata, causing the gateway to proxy requests - including cloud credentials - to an attacker-controlled server. All AI Gateway releases from 18.9.0 through 19.2.2 are affected across three version branches; GitLab has confirmed remediation. A public exploit exists per the HackerOne reference, and the CVSS Scope Change metric (S:C) reflects that successful exploitation extends compromise to external cloud infrastructure beyond the GitLab instance itself.
Arbitrary CI command execution in GitLab Enterprise Edition allows an authenticated developer-role user to run unauthorized commands within a CI pipeline context across all EE versions from 18.9 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1. The root cause is CWE-829 (Inclusion of Functionality from Untrusted Control Sphere): a Claude AI agent integration within GitLab EE processes CI pipeline configuration drawn from a user-controlled source without adequate isolation, enabling instruction injection into the agent's execution context. A public proof-of-concept is confirmed via HackerOne report 3863650, though SSVC and EPSS signals indicate no observed widespread active exploitation at time of analysis.
Stack-based buffer overflow in GNOME Dia diagram editor (0.98.0 and earlier) permits stack exhaustion and potential return-address corruption when a victim opens a crafted .dia XML file containing a Bus object with an attacker-controlled bus_handles value and then moves a handle in the diagram. The root cause - an unbounded g_alloca() call driven by an unvalidated file attribute - is also present in objects/Misc/tree.c via Tree objects, widening the attack surface. No public exploit or CISA KEV listing exists at time of analysis, but the GitLab issue provides sufficient technical detail for proof-of-concept development.
Remote code execution in GitLab CE/EE package registry exposes instances across three active version branches to full host compromise by an authenticated low-privilege user. Path traversal (CWE-22) in the package registry component allows directory escape and arbitrary file write under certain server-side conditions, with CVSS scope change (S:C) confirming that impact extends beyond the GitLab application to the underlying host. A publicly available exploit exists via HackerOne report 3754194, though this vulnerability is not listed in the CISA KEV catalog at time of analysis.
GraphQL multiplex query handling in GitLab CE/EE improperly validates request methods, permitting unauthenticated attackers to trigger state-changing mutations via HTTP GET requests, effectively bypassing CSRF protections. All GitLab CE/EE deployments running versions 18.2 through the affected ranges across the 18.x, 19.0, 19.1, and 19.2 release lines are exposed. A publicly available exploit exists via HackerOne disclosure, and successful exploitation allows an attacker to perform arbitrary data-modifying operations on behalf of any authenticated GitLab user who can be lured to a malicious page.
Unauthenticated data tampering in GitLab CE/EE (18.2-18.11.10, 19.0-19.0.7, 19.1-19.1.5, 19.2-19.2.3) lets a remote attacker modify or delete public projects and user data by abusing a GraphQL directive, per CVE-2026-19478 (CVSS 9.4). The flaw was self-reported by GitLab and publicly available exploit code exists via a HackerOne disclosure, though it is not listed in CISA KEV. Impact is weighted toward integrity and availability rather than data theft (CVSS C:L/I:H/A:H).
Stored cross-site scripting in GitLab CE/EE's analytics dashboard component allows an authenticated low-privilege user to inject malicious JavaScript into table cell content that executes in the browsers of other users who view the affected dashboard. The scope change (S:C in CVSS) confirms the impact crosses security boundaries, enabling session hijacking, credential theft, or unauthorized API actions on behalf of victims including administrators. A publicly available proof-of-concept exploit exists via HackerOne report #3830478; no confirmed active exploitation in CISA KEV at time of analysis.
Stored or reflected cross-site scripting in GitLab CE/EE's analytics dashboard allows an authenticated attacker with low privileges to inject malicious scripts into pagination controls, executing in the browser context of any user who views the affected page. Affected versions span 18.2 through 19.2.1 across all three supported release trains. A publicly available proof-of-concept exists via HackerOne report 3830061; the Changed scope (S:C) and High C/I impacts elevate real-world risk significantly beyond a typical low-privilege XSS.
Privilege escalation in GitLab Enterprise Edition exposes project governance controls to any authenticated project member due to missing authorization checks on the project update API endpoint. Affecting EE versions 19.1.0 through 19.1.3 and 19.2.0 through 19.2.1, this flaw lets lower-privileged users (developers, reporters) silently overwrite project settings normally restricted to maintainers or owners - including branch protection rules, merge approval requirements, and access policies. A publicly available exploit exists via HackerOne; active exploitation is not confirmed by CISA KEV, but the low attack complexity combined with public proof-of-concept code significantly elevates operational urgency.
Improper authorization of namespace identity in GitLab Enterprise Edition 19.1.x and 19.2.x allows an authenticated low-privilege user to attribute AI feature usage to arbitrary namespaces they do not own, crossing organizational authorization boundaries within a multi-tenant deployment. The flaw, classified as CWE-639, arises because user-supplied identity information in requests is insufficiently validated before being used to authorize namespace-scoped AI operations, producing a scope change that affects namespaces beyond the attacker's own. GitLab has released patches in versions 19.1.4 and 19.2.2, and no public exploit code exists at time of analysis.
Denial of service in GitLab CE/EE (versions 18.5 through pre-19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2) allows unauthenticated remote attackers to exhaust server resources through improper input validation, rooted in CWE-770 (resource allocation without throttling limits). Exploitation is conditional - the description explicitly qualifies 'under certain conditions' - which is reinforced by SSVC classifying the attack as non-automatable despite a CVSS PR:N/AC:L rating. A publicly available proof-of-concept exists via a HackerOne disclosure, though EPSS sits at only 0.41% (34th percentile) and CISA has not listed this in the KEV catalog, suggesting exploitation remains opportunistic rather than widespread.
Improper authorization in GitLab CE/EE pipeline reference validation allows authenticated developer-role users to execute CI/CD pipelines on protected branches they lack push permissions to access, effectively bypassing branch protection policies. All GitLab versions from 19.0 through 19.2 are affected until the respective patch releases. A publicly available exploit exists via HackerOne report #3832069, though no confirmed active exploitation has been recorded in the CISA KEV catalog at time of analysis.
Stored cross-site scripting in GitLab CE/EE 19.2 before 19.2.2 lets an authenticated user holding only developer-role permissions inject unsanitized HTML that executes in the browser of a higher-privileged user who opens a CI job modal, enabling privilege escalation. Publicly available exploit code exists (HackerOne report #3880796), though EPSS is modest at 0.30% (22nd percentile) and CISA SSVC records no observed exploitation. The high CVSS 9.0 is driven by a scope change and total confidentiality/integrity/availability impact once the payload runs in a victim's session.
Authenticated command injection in Dokploy (self-hostable PaaS) versions 0.29.3 through 0.29.12 lets a low-privileged user achieve arbitrary host command execution by storing a malicious Git branch value and triggering a deployment. The branch fields (customGitBranch, branch, gitlabBranch, bitbucketBranch, giteaBranch) were left without server-side validation because the earlier fix for CVE-2026-45628 was incomplete, so attacker-controlled input flows unescaped into shell-based git clone commands. No public exploit has been identified at time of analysis, but the flaw carries a CVSS of 9.9 and is fixed in 0.29.13.
Improper attribute validation in GitLab CE/EE (18.0 through 19.0.5, 19.1 through 19.1.3, 19.2 through 19.2.1) lets an authenticated user tamper with CI/CD configuration owned by another user by injecting user-controlled attributes into pipeline schedule input processing. Publicly available exploit code exists (HackerOne #3800511), though the flaw is not listed in CISA KEV and requires authentication plus high-complexity conditions to trigger. GitLab, the reporter, has shipped fixed releases across all supported branches.
Denial of service in GitLab CE/EE (all versions from 11.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1) allows an unauthenticated attacker to exhaust server resources through insufficient throttling when the application processes merge request discussions. Vendor-reported by GitLab with no public exploit identified at time of analysis; the availability-only impact (CVSS 7.5, A:H) reflects service disruption rather than data compromise. Exploitation is conditional ('under certain conditions'), which tempers the otherwise network-reachable, no-auth attack surface.
Server-side request forgery and internal repository exfiltration in Gitea before 1.27.0 lets a low-privileged authenticated user bypass the migration URL allow/block list by supplying a permitted public Git URL that HTTP-redirects the server's git subprocess to an otherwise-blocked internal endpoint. Because Gitea validates only the originally submitted URL while git runs with its default http.followRedirects=initial, the redirected internal Git repository is cloned into an attacker-controlled repository, and pull mirrors keep re-fetching it on schedule. No public exploit identified at time of analysis; a vendor-authored local proof-of-concept confirmed the redirect is followed to 127.0.0.1, and EPSS/KEV data were not supplied.
GitLab API request redirection in zereight's mcp-gitlab (gitlab-mcp) MCP server lets attackers who control the job_id parameter escape the intended /jobs/ path prefix and reach arbitrary GitLab REST API endpoints under the operator's personal access token. Because the token is a bearer of the operator's full GitLab privileges, a crafted value such as '../../../user' resolves to /api/v4/user (or any other resource), turning a scoped job lookup into broad unauthorized data access. No public exploit was identified at time of analysis, and it is not listed in CISA KEV, but the flaw is trivially triggerable and was reported by VulnCheck with a vendor fix committed.
Credential leakage in electron-updater (the auto-update component of electron-builder / builder-util-runtime) before 9.7.0 allows an attacker controlling a redirect target to harvest update-feed credentials. The HTTP redirect handler only stripped a header keyed exactly as lowercase "authorization", so PRIVATE-TOKEN (GitLab personal access tokens) and mixed-case Authorization (GitLab Bearer/OAuth) headers were forwarded to attacker-controlled cross-origin redirect destinations. There is no public exploit identified at time of analysis, but the upstream fix is published in version 9.7.0.
Approval-gate bypass in Woodpecker CI before 3.15.0 lets an attacker who can open a merge request from a fork against a GitLab-backed repository run unapproved, attacker-controlled pipelines. Because the GitLab forge driver populates pipeline.Author from the spoofable git commit author name (commit.author.name) rather than the GitLab-validated user identity, an attacker simply sets the commit author to a name listed in ApprovalAllowedUsers, making needsApproval return false. This grants arbitrary CI step execution on a Woodpecker agent and exposure of CI secrets; there is no public exploit identified at time of analysis, but the issue was reported by VulnCheck and is trivially reproducible.
Denial of service in linkify-it (npm) through v5.0.0 lets remote unauthenticated attackers wedge a rendering worker by submitting tens of KB of repeated email/link-like text. The core public API LinkifyIt.prototype.match runs an O(N²) scan loop that re-slices the input and re-runs unanchored fuzzy regex searches once per match, so 64 KB of "a@b.com" burns ~2.5 s of single-threaded CPU and 128 KB ~10 s. The flaw is inherited by markdown-it (~21.6M weekly npm downloads) whenever linkify:true is set, exposing forums, chat, wikis and AI chat UIs; publicly available exploit code (a PoC in the GHSA advisory) exists, but there is no evidence of active exploitation.
Information disclosure in GitLab Enterprise Edition 19.1 (before 19.1.1) lets a user retrieve sensitive data previously committed to a project because Duo Workflows fails to adequately filter its output under certain conditions. The flaw exposes confidential repository content through GitLab's AI workflow feature without altering or destroying data. No public exploit is identified at time of analysis and CISA SSVC rates exploitation as 'none', though EPSS sits at a modest 0.33% (25th percentile).
Denial of service in libtiff v4.7.1 and prior allows processing of a crafted TIFF file containing an abnormally large SamplesPerPixel tag value to crash or hang the affected process. Any application or service that passes attacker-controlled TIFF files through libtiff is potentially vulnerable, including web-based image processors, document converters, and media ingestion pipelines. No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at the time of this analysis.
Improper authorization in DevGuard versions prior to v1.4.2 allows any authenticated user on the instance - including users with no membership in the target organization, project, or asset - to perform write operations on vulnerability-triage endpoints of any public asset. The flaw lets attackers create, modify, or delete VEX rules, dependency-vulnerability events, license risks, external references, and artifacts, corrupting the integrity of published vex.json/sbom.json output consumed by downstream supply-chain users. No public exploit identified at time of analysis, and EPSS probability is very low (0.04%, 11th percentile), reflecting the niche audience but not the integrity blast radius.
Account takeover in GitLab Enterprise Edition versions 15.5 through 19.0.2 allows an authenticated group Owner to hijack other group members' accounts through improper authorization in the Group SAML identity management functionality. Publicly available exploit code exists via a HackerOne report, and GitLab released patched versions 18.10.8, 18.11.5, and 19.0.2 on 2026-06-10. The flaw stems from CWE-639 (Authorization Bypass Through User-Controlled Key) and yields a scope-changing high-impact compromise per CVSS 3.1.
Denial of service in GitLab CE/EE versions 12.10 through 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 allows unauthenticated remote attackers to crash or degrade the API request parsing middleware via malformed input. Publicly available exploit code exists (HackerOne report 3671995), and the CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/A:H) reflects trivially-reachable, no-auth exploitation against any internet-exposed GitLab instance. No CISA KEV listing at time of analysis.
Stored cross-site scripting and account integrity abuse in GitLab Enterprise Edition versions 13.1.4 through 18.10.7, 18.11 prior to 18.11.5, and 19.0 prior to 19.0.2 allows an authenticated low-privileged user to inject unsanitized input into certain group setting fields and add unauthorized email addresses to a targeted user's account. Publicly available exploit code exists via a HackerOne report, though EPSS exploitation probability remains very low at 0.02% and the SSVC framework rates current exploitation as 'none' with total technical impact when successful.
Stored cross-site scripting in GitLab Enterprise Edition's Analytics Dashboard allows an authenticated developer-role user to execute arbitrary client-side JavaScript in the browser of a targeted user, leveraging improper input sanitization. The flaw affects all 17.1 through 18.10.x, 18.11.x, and 19.0.x branches before fixed releases, and publicly available exploit code exists via a HackerOne report, raising the realistic risk of opportunistic abuse against multi-tenant GitLab instances.
Identity confusion in GitLab EE's Duo AI workflow runners lets an authenticated, low-privileged user cause specific Duo AI workflows to execute under another user's identity, crossing the trust boundary between accounts (CVSS scope: changed). The flaw stems from improper user identity resolution and affects GitLab Enterprise Edition 18.8 through 18.10.6, 18.11 through 18.11.3, and 19.0, with High confidentiality and integrity impact but no availability impact. No public exploit has been identified, CISA's SSVC marks exploitation as 'none,' and the High attack complexity (AC:H) combined with the 'under certain conditions' caveat indicates exploitation is non-trivial rather than push-button.
Command injection in Prefect 3.6.18's GitHub integration allows authenticated users to execute arbitrary git commands through the unsanitized reference field. The GitHubRepository block concatenates user input directly into git clone commands, enabling attackers to inject malicious options that can lead to SSRF, credential theft, or remote code execution. While no active exploitation is confirmed, the straightforward attack vector and high impact make this a priority for organizations using Prefect's GitHub integration features.
Unauthenticated agent token theft in Coder v2 (self-hosted developer workspace platform) stems from azureidentity.Validate() verifying the PKCS#7 signer's certificate chain but skipping signature verification of the signed content itself. Remote attackers who know a target VM's vmId (a UUIDv4) can forge a PKCS#7 envelope containing a legitimate Azure certificate alongside attacker-controlled content and POST it to the unauthenticated /api/v2/workspaceagents/azure-instance-identity endpoint to receive the victim workspace agent's session token, which then unlocks Git SSH keys, OAuth tokens for GitHub/GitLab/Bitbucket, and workspace secrets. No public exploit identified at time of analysis, but the vulnerability is vendor-confirmed via GHSA-6x44-w3xg-hqqf and a detailed root-cause analysis with attack-path diagram is published.
Broken access control in Arcane's GitOps backend (versions <= 1.18.1) allows any authenticated low-privilege user to exfiltrate plaintext Git credentials (PATs/SSH keys) stored for source-of-truth repositories. Eight of nine /api/customize/git-repositories endpoints omit the checkAdmin() gate, letting a 'user' role attacker repoint a repository URL to an attacker-controlled host and trigger a /test or /branches call that transmits the decrypted token via HTTP Basic auth. No public exploit identified at time of analysis, but the GHSA advisory documents a complete attack chain and a patched release (1.19.0) is available.
Stored cross-site scripting in GitLab Enterprise Edition lets an authenticated user holding Developer-role permissions inject arbitrary JavaScript that executes in the browsers of other users who view the affected content. The flaw stems from improper input sanitization and affects all 16.4-series through 18.11.x releases prior to the 18.9.7, 18.10.6, and 18.11.3 patch releases. No public exploit identified at time of analysis, and EPSS is very low (0.02%), but CVSS is rated 8.7 because the scope-changing XSS can hijack higher-privileged user sessions.
Stored cross-site scripting in GitLab Enterprise Edition's customizable analytics dashboards allows an authenticated user to execute arbitrary JavaScript in the browsers of other users who view the affected dashboard. The flaw affects EE 18.7-18.9.6, 18.10-18.10.5, and 18.11-18.11.2, carries a CVSS 8.7 (scope-changed) rating, and a vendor patch is available. No public exploit identified at time of analysis and EPSS is very low (0.02%, 5th percentile).
Stored cross-site scripting in GitLab Enterprise Edition 18.7-18.11.x allows an authenticated user to inject arbitrary JavaScript that executes in other users' browser sessions due to improper input sanitization. The CVSS 8.7 score is elevated by Scope:Changed (S:C), reflecting that injected script can pivot across security contexts and potentially target administrators. No public exploit identified at time of analysis, EPSS is very low (0.02%, 5th percentile), and SSVC indicates no observed exploitation, but a vendor patch is available across all three affected branches.
Denial of service in GitLab CE/EE allows unauthenticated remote attackers to disrupt service availability by sending specially crafted requests that exploit insufficient input validation. Affected versions span 9.0 through 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 across both Community and Enterprise editions, with no public exploit identified at time of analysis and a low EPSS score (0.04%) indicating limited near-term exploitation likelihood despite the network-reachable attack surface.
Unauthenticated remote access to GitLab API operations via gitlab-mcp-server's SSE transport allows attackers to execute all 86 exposed GitLab management tools-including repository deletion, file modification, and configuration changes-using the operator's Personal Access Token. When configured with USE_SSE=true (a documented feature), the Node.js server binds to 0.0.0.0 with wildcard CORS headers, enabling both network-adjacent attackers and malicious web pages to invoke destructive operations without credentials. Public exploit code demonstrates the attack path from initial SSE connection through authenticated GitLab API calls. Patch version 0.6.0 addresses the authentication bypass per GitHub advisory GHSA-8jr5-6gvj-rfpf.
Cross-Site Request Forgery (CSRF) in GitLab CE/EE allows remote unauthenticated attackers to execute GraphQL mutations as authenticated victims through crafted web pages. Affects all versions from 17.0 through 18.11.0, with publicly available exploit code (HackerOne report 3627285). Despite high CVSS 8.1, exploitation requires user interaction (phishing/social engineering) and is not automatable per CISA SSVC framework. No evidence of active exploitation in CISA KEV at time of analysis. Vendor patches released: 18.9.6, 18.10.4, and 18.11.1.
Cross-site scripting vulnerability in GitLab's Storybook development environment allows remote unauthenticated attackers to steal access tokens via crafted user interaction. Affects GitLab CE/EE versions 16.1.0 through 18.9.5, 18.10 through 18.10.3, and 18.11.0. Publicly available exploit code exists (HackerOne report 3574642), though CISA SSVC indicates no confirmed active exploitation at time of analysis. CVSS 8.0 reflects high confidentiality and integrity impact with scope change, but CVSS vector AC:H (high complexity) and UI:R (user interaction required) indicate exploitation requires targeted social engineering rather than automated mass exploitation.
Cross-site scripting (XSS) in GitLab CE/EE versions 18.10.0-18.10.3 and 18.11.0 enables unauthenticated attackers to execute arbitrary JavaScript in victim browser sessions via improper path validation. GitLab disclosed this vulnerability with publicly available exploit code (HackerOne report 3572231), though CISA SSVC indicates no active exploitation confirmed at time of analysis. CVSS 8.0 reflects the changed scope (S:C) allowing impact beyond the vulnerable component, though High attack complexity (AC:H) and required user interaction (UI:R) limit ease of exploitation. Patched in versions 18.10.4 and 18.11.1.
Credential leakage in Tekton Pipelines git resolver allows authenticated users to exfiltrate system-configured Git API tokens (GitHub PAT, GitLab tokens) by directing the resolver to attacker-controlled endpoints. Affects versions 1.0.0 through 1.10.0 when users omit the token parameter in TaskRun or PipelineRun configurations. CVSS 7.7 with scope change reflects cross-tenant credential theft potential in multi-tenant Kubernetes environments. No active exploitation confirmed (not in CISA KEV), but exploitation is straightforward for authenticated cluster users with TaskRun/PipelineRun creation privileges.
Improper access control in GitLab CE/EE 16.9.6-18.10.2 enables authenticated attackers to invoke unauthorized server-side methods via websocket connections, achieving high-severity information disclosure with changed scope. Affects continuous integration/deployment platforms running vulnerable GitLab instances. Exploitation requires low-privilege authentication but no user interaction, enabling lateral information access across security boundaries.
Denial of service in GitLab CE/EE versions 12.10 through 18.8.8, 18.9 through 18.9.4, and 18.10 through 18.10.2 allows unauthenticated remote attackers to crash GitLab services via malformed JSON payloads. Improper input validation (CWE-1284) enables resource exhaustion attacks without authentication. CVSS 7.5 (High) reflects network-accessible attack with low complexity requiring no user interaction. No public exploit identified at time of analysis. EPSS data unavailable; not listed in CISA KEV.
Improper authorization in GitLab CE/EE Jira Connect integration allows authenticated users with minimal workspace permissions to steal installation credentials and impersonate the GitLab application. Affects versions 14.3 through 18.8.6, 18.9.0-18.9.2, and 18.10.0. Vendor-released patches available in versions 18.8.7, 18.9.3, and 18.10.1. High CVSS score (8.1) reflects significant confidentiality and integrity impact with low attack complexity. No public exploit identified at time of analysis, though detailed disclosure exists via HackerOne report.
Improper HTML sanitization in GitLab EE versions 15.4-18.10.1 allows authenticated users to add email addresses to arbitrary user accounts, potentially enabling account takeover or unauthorized access escalation. Public exploit code exists for this vulnerability, and no patch is currently available. Affected deployments should implement access controls to restrict user modification privileges until updates become available.
A Cross-Site Request Forgery (CSRF) vulnerability in GitLab Community Edition and Enterprise Edition allows unauthenticated attackers to execute arbitrary GraphQL mutations on behalf of authenticated users without their consent. All versions from 17.10 before 18.8.7, versions 18.9 before 18.9.3, and versions 18.10 before 18.10.1 are affected. A public proof-of-concept exploit is available via HackerOne report 3584382, significantly increasing the risk of active exploitation.
GitLab CE/EE contains a denial of service vulnerability in GraphQL request processing due to improper input validation (CWE-407). All versions from 18.5 through 18.8.6, 18.9 through 18.9.2, and 18.10 before 18.10.1 are affected. An unauthenticated attacker can remotely exploit this with low complexity to render GitLab instances unresponsive, and a public proof-of-concept exploit is available via HackerOne report 3597342.
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.6 versions up to 18.7.6 is affected by cross-site scripting (xss) (CVSS 8.7).
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.9 versions up to 18.9.2 is affected by uncontrolled recursion (CVSS 7.5).
Gitlab versions up to 18.7.5 is affected by allocation of resources without limits or throttling (CVSS 7.5).
Gitlab versions up to 18.7.5 is affected by inefficient regular expression complexity (redos) (CVSS 7.5).
Multiple out-of-bounds read and write defects in the X.Org X client libraries (libX11, libXi, libXpm, libXrender, libXtst) let a malicious or compromised X server send crafted replies that drive client-side parsers past the end of the received buffer, crashing the linked application and, in the libX11 XKB case, writing past an allocated array. Affected are libX11 before 1.8.14, libXi before 1.8.4, libXpm before 3.5.20, libXrender before 0.9.13 and libXtst before 1.2.6; exploitation requires the victim's client to connect to an untrusted server and, per the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H (6.5), the craftwork is unauthenticated but needs user interaction, with demonstrated impact limited to denial of service rather than code execution. No CVSS vector, EPSS score, KEV entry or POC indicator was supplied for CVE-2026-109090 specifically, so no public exploit identified at time of analysis and quantitative exploitation signals are absent.
Out-of-bounds reads and writes in the X.Org X client libraries (libX11, libXi, libXpm, libXrender and libXtst) can be triggered when a connecting X11 client parses crafted replies or events returned by a malicious, compromised, or man-in-the-middled X server, causing client crashes and, in a subset of cases, limited memory disclosure. The lead issue in the advisory is an out-of-bounds write in libX11's XKB action parser when a XkbGetMap reply contains keycode values above max_keycode + 1; the family also includes multiple out-of-bounds reads in libXi's XI2 class parsing and XQueryDeviceState/XListInputDevices replies, all of which are fixed in libX11 1.8.14, libXi 1.8.4, libXpm 3.5.20, libXrender 0.9.13 and libXtst 1.2.6. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, 6.5) indicates exploitation is unauthenticated but requires user interaction, with impact limited to denial of service rather than confirmed code execution; no public exploit identified at time of analysis, and no KEV entry or EPSS score was supplied.
Out-of-bounds reads in the X.Org X client libraries - libXrender before 0.9.13 and libXtst before 1.2.6 in the parsing paths covered by this entry, alongside the sibling fixes shipped in libX11 1.8.14, libXi 1.8.4 and libXpm 3.5.20 - let a malicious or compromised X server crash connecting clients by returning malformed protocol replies. The clients trust length, count and category fields supplied by the server (for example the depth, visual and subpixel counts used when building XRenderInfo, and the datum/category handling in libXtst's XRecord reply parser) without validating them against the actual received buffer, so parsing walks past the end of the packet and causes a denial of service. Per the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H (6.5), the attacker is unauthenticated from the network but exploitation requires user interaction - the victim must launch or connect an affected client to the hostile server (for example via ssh -X/-Y X11 forwarding to a compromised display) - and there is no public exploit identified at time of analysis.
Cache poisoning of raw repository file responses in GitLab CE/EE (all versions before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2) lets a low-privileged authenticated user supply crafted repository references so that cached raw-file content is served to other users. When a targeted victim's CI/CD pipeline subsequently fetches that poisoned raw file, the pipeline executes attacker-controlled content, potentially exposing protected environment variables. Publicly available exploit code exists (referenced via a HackerOne report), but the issue is not confirmed as actively exploited (no CISA KEV listing); exploitation is rated high complexity (AC:H), requires authentication (PR:L), and success depends on a victim pipeline actually pulling and running the poisoned content, making this a credible, high-priority issue rather than an emergency.
An authenticated user holding only the Developer role can run CI/CD pipelines on protected branches in GitLab CE/EE without authorization, because the downstream (multi-project/child) pipeline creation service failed to enforce proper permission checks (CWE-863). All versions from 18.7 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 are affected, and exploitation is conditional: it requires a valid Developer account plus projects that combine downstream pipelines with protected-branch restrictions, which is why the independent assessment raises attack complexity to High even though the vendor rates the issue 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N). Publicly available exploit code exists in the form of a HackerOne report, but the provided data contains no confirmation of active exploitation and no KEV listing. Integrity impact is the dominant risk: unauthorized pipeline execution on a protected branch can inject or alter build, test, and deployment artifacts that the branch protection model was designed to shield.
Improper cleanup of scheduled pipeline execution policy records in GitLab Enterprise Edition lets an authenticated user execute arbitrary CI/CD pipelines in a transferred project using the destination group's privileges. Affected releases are all EE versions from 18.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2. Exploitation is conditional - the attacker needs a valid account, a project that has a configured scheduled pipeline execution policy, the project-transfer workflow, and user interaction (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N, 7.7) - but publicly available exploit code exists per the referenced HackerOne report, and no CISA KEV entry has been recorded, so this is a moderate, conditional privilege-escalation risk rather than a mass-exploitation emergency.
Stored cross-site scripting in GitLab CE/EE (affected ranges 19.1 through 19.2.7, 19.3 through 19.3.4, and 19.4 through 19.4.1) lets an authenticated user with repository write access embed a crafted file whose syntax-highlighted output is rendered with unsanitized HTML attributes, executing arbitrary JavaScript in the browser session of any other user who views it. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N reflects that the attacker must be authenticated (PR:L) and that a second user must render the malicious content (UI:R), but that successful execution crosses a trust boundary (S:C) with high confidentiality and integrity impact, including potential theft of session tokens or actions taken as the victim. Exploitation requires publicly available exploit code exists, with a HackerOne report and the upstream work item publicly linked; CISA KEV status was not indicated in the supplied intelligence, so this should be treated as a high-priority authenticated stored XSS rather than a confirmed actively exploited campaign. The affected surface is bounded by the requirement for repository control plus a victim viewing the highlighted file, so unauthenticated or pure drive-by exploitation is not possible.
Remote code execution in GitLab CE/EE (all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2) allows an unauthenticated attacker to execute arbitrary code on the GitLab server by supplying a specially crafted regular expression in a CI/CD configuration that passes insufficient regex validation; the defect is tracked as CWE-190 (integer overflow) and the vendor scores it 10.0 with scope change (S:C). Publicly available exploit code exists, referenced through HackerOne reports cited in the CVE record, but there is no CISA KEV entry and no confirmed active exploitation at time of analysis. Our independent assessment retains the same impact (C:H/I:H/A:H) but raises attack complexity to AC:H, because the vendor states the regex-validation path is reached by an unauthenticated user only 'under certain conditions' that are not detailed publicly and should be confirmed with GitLab; patched instances (19.4.2, 19.3.5, 19.2.8 or later) are not affected.
Authenticated users of GitLab Enterprise Edition can inject specially crafted content into the context that AI agent features assemble, allowing unintended commands to be executed and attributed to other users. The issue affects GitLab EE from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2, and exploitation requires a valid EE account (PR:L), the AI agent/conversation feature to be enabled and in use, and a separate victim user to trigger the affected AI interaction (UI:R), so realistic exposure is substantially narrowed despite the network attack vector. No public exploit code or confirmed active exploitation was identified at time of analysis; vendor-released patches are available in versions 19.2.8, 19.3.5, and 19.4.2.
A use-after-free in the XInput2 passive grab handling of X.Org X server builds prior to xorg-server-21.1.25 and Xwayland prior to xwayland-24.1.14 allows an authenticated client that can add and remove XI2 master devices to crash the server or potentially achieve arbitrary code execution. The attacker creates a passive grab whose modifierDevice points at a master device, then calls XIRemoveMaster to free that device; the grab retains a dangling DeviceIntPtr that later input processing dereferences, corrupting the heap. Reaching the vulnerable code requires a valid client connection to the X server or Xwayland (typically local, since modern X servers do not listen on TCP by default) and the XI2 extension, which is enabled by default; no public exploit code and no CISA KEV entry have been identified at time of analysis.
Heap-based buffer overflow in X.Org X server and Xwayland's glamor acceleration backend (glamor_upload_boxes) allows an authenticated local X client to cause memory corruption, potentially leading to arbitrary code execution or denial of service. The flaw occurs when a 24-bit drawable is used with a 32-bit pixmap and crafted dimensions trigger an integer overflow in size calculation, affecting X.Org X server versions prior to 21.1.25 and Xwayland versions prior to 24.1.14. No public exploit code or active exploitation has been identified at time of analysis, but the vulnerability requires a local authenticated connection and glamor hardware acceleration to be enabled.
Heap-based buffer overflow in X.Org X server and Xwayland GLX RenderLarge request handling allows an authenticated local X client to write past the allocated heap buffer, potentially achieving arbitrary code execution or causing denial of service. Affected versions are xorg-server prior to 21.1.25 and Xwayland prior to 24.1.14; the attacker must already be able to open an X display with GLX available, which by default means local Unix-socket access rather than remote unauthenticated access. No public exploit identified at time of analysis.
Use-after-free in the Present extension of X.Org X server before 21.1.25 and Xwayland before 24.1.14 lets an authenticated X client crash the display server and potentially expose limited process memory. An attacker with the ability to open an X display connection creates cross-window Present notify entries pointing at a separate target window and then destroys that window, so the freed per-window notify list is traversed after present_clear_window_notifies() releases the window's private data without unlinking the entries; both the Present and SYNC extensions must be enabled, which they are by default. The issue is a local, low-privilege, user-interaction-free memory-safety bug (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H), and no CISA KEV listing, EPSS score, or public exploit code was identified at time of analysis.
A double free in the X.Org X server's XKB SetGeometry request handler (CVE-2026-88812) lets an authenticated X client that is already able to connect to the target display corrupt heap memory by sending a crafted XkbSetGeometry request containing a malformed TextDoodad entry, with outcomes ranging from a server crash to potential arbitrary code execution. Only builds of xorg-server prior to 21.1.25 and Xwayland prior to 24.1.14 are affected, and the XKB extension required for the trigger is standard and enabled by default. The assessed vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning exploitation presupposes an existing local/same-session X connection rather than remote or unauthenticated access, and no public exploit code, EPSS score, or CISA KEV entry appears in the supplied data, so reliable code execution additionally depends on defeating heap allocator hardening.
Multiple memory-safety defects in X.Org X server prior to xorg-server-21.1.25 and Xwayland prior to xwayland-24.1.14 let an authenticated X client corrupt server heap and stack memory through crafted XKB, Present, XInput2, GLX and XFixes protocol requests, causing crashes or potentially arbitrary code execution inside the X server process. The flaws include a double free in XKB SetGeometry TextDoodad handling, use-after-frees in the Present cross-window notify path and in XInput passive grabs after XIRemoveMaster, heap overflows in GLX RenderLarge and XkbResizeKeyType, an XFixes pointer-barrier event buffer overflow, and an incomplete-fix out-of-bounds write in the XKB ChangeKeycodeRange path. Exploitation requires a connection already authorized to the X server (typically a local user session, an X11-forwarded session, or a multi-seat/shared-display host); no public exploit code and no confirmed in-the-wild exploitation have been identified at time of analysis, and the assessed vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Pure-Wayland deployments that do not run Xwayland are not exposed.
Heap buffer overflow in X.Org X Server versions prior to 21.1.25 and in Xwayland prior to 24.1.14 stems from an integer truncation inside XkbResizeKeyType(), where the computed key-symbol count is stored in an unsigned short and wraps for sufficiently large nTotal values, yielding an undersized allocation that subsequent writes overflow. The X.Org advisory of October 2026 states the trigger is an X client sending crafted XKB requests that resize a key type with a large nTotal; because no CVSS vector was supplied, authentication requirements are not confirmed from available data, and the advisory's own phrasing describes the actor as an authenticated X client. No CVSS score, EPSS estimate, CISA KEV listing, or public exploit code was available at time of analysis, so no public exploit identified at time of analysis; the vendor assesses the impact as heap corruption that can lead to arbitrary code execution or denial of service. This CVE is one of seven flaws disclosed together in the same X.Org security advisory.
Heap out-of-bounds write in the X.Org X server (versions prior to xorg-server-21.1.25) and Xwayland (versions prior to xwayland-24.1.14) allows an authenticated X client to corrupt heap memory by issuing an XkbChangeKeycodeRange request that sets a keycode range where MAP_LENGTH exceeds max_key_code+1, leaving XkbAllocNames under-allocated while the subsequent memset writes MAP_LENGTH bytes. The flaw is an incomplete fix of an earlier XKB keycode-range change (commit a3171732d) and is scored locally as CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning the attacker must already hold an authorized X connection - a local session, a compromised GUI application on the same display, or a forwarded X session - rather than merely reaching the host over the network. No CVSS vector, EPSS score, KEV listing, or public exploit code is present in the supplied data, so this analysis rests solely on the X.Org advisory text and no public exploit has been identified at time of analysis; the same October 7, 2026 advisory bundles six further memory-safety issues (CVE-2026-88812, -93515, -93516, -93517, -93518, -93519) fixed in the same releases.
Buffer overflow in X.Org X Server's XFixes extension (and Xwayland) allows an authenticated local X client to trigger a stack or heap overflow by creating more than 100 pointer barriers and generating pointer motion events, potentially leading to arbitrary code execution or denial of service. The flaw, tracked as CVE-2026-93519, affects X.Org X server versions prior to 21.1.25 and Xwayland versions prior to 24.1.14. No public exploit code or active exploitation has been identified at time of analysis; independent assessment assigns a CVSS 3.1 vector of AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Heap buffer overflow in the glamor acceleration path of the X.Org X server (and Xwayland) allows an authenticated local X client to corrupt the server's heap, with the potential for code execution or a server crash, although reliable exploitation is assessed as high-complexity. The flaw is addressed in the October 2026 X.Org security release, which fixes a bundle of XKB, Present, XInput, GLX and XFixes issues in xorg-server 21.1.25 and xwayland 24.1.14. No public exploit code and no CISA KEV entry were identified at time of analysis; no CVSS vector or EPSS score was supplied for this CVE, and the input itself does not contain a CVE-2026-93523 advisory entry, so the mapping of this identifier to the glamor size-calculation overflow is inferred from an associated upstream commit rather than confirmed by vendor text.
Heap memory corruption in the X.Org X server (prior to 21.1.25) and Xwayland (prior to 24.1.14) arises from a cluster of flaws disclosed in the October 2026 X.Org security advisory, for which CVE-2026-93524 serves as the coordinating identifier. An authenticated local X client that can already open and authenticate to the display socket can trigger double-free, use-after-free, numeric-truncation and heap buffer overflow conditions across the XKB, Present, XInput, GLX and XFixes extensions, causing server crashes and - where heap layout protections are defeated - potentially arbitrary code execution. The assessed vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H; no public exploit code, EPSS score or CISA KEV listing was present in the source data, so no public exploit is identified at time of analysis, and the advisory text does not state the specific trigger conditions for CVE-2026-93524 itself.
Account takeover in Plane (makeplane) versions prior to 1.4.0 allows remote unauthenticated attackers to log in as existing users by exploiting OAuth email trust in Gitea and self-managed GitLab deployments where email confirmation is disabled. The vulnerability (CWE-287) stems from Plane matching the email returned by the OAuth provider to a local account without verifying provider-side ownership; an attacker can set an OAuth identity's unverified email to the victim's address and authenticate as them without knowing the password, as confirmed by the provided independent assessment. Deployments using GitHub, GitLab.com, or Google OAuth are not affected because those providers return verified emails; no public exploit identified at time of analysis, and the flaw is gated by deployment configuration rather than being universally exploitable.
Remote command execution on the GitLab AI Gateway is achievable by an authenticated user who has been granted Duo Agent Platform access, by supplying a specially crafted flow configuration whose prompt template escapes the intended sandbox (CVE-2026-90970). The flaw is a server-side template injection (CWE-1336) rated CVSS 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), meaning a single low-privileged authenticated account yields high confidentiality, integrity, and availability impact that extends beyond the vulnerable component's own security scope. Affected deployments are AI Gateway versions 18.1.6 up to but not including 19.2.4, 19.3 before 19.3.2, and 19.4 before 19.4.1; GitLab has remediated the issue and no public exploit identified at time of analysis, though the requirement for Duo Agent Platform to be enabled and for the attacker to hold a legitimate authenticated account with access to it materially narrows the exposed population.
Stored cross-site scripting in GitLab CE/EE lets an authenticated user who can create or modify a merge request embed crafted content in a path component that the merge request diff viewer fails to sanitize, so arbitrary JavaScript executes in the browser session of any other user who views that diff. All versions from 13.11 up to the fixed releases 19.2.7, 19.3.3 and 19.4.1 are affected; the CVSS 3.1 base score is 8.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N), reflecting network reachability, low privileges required, mandatory victim interaction, and a scope change because the attacker compromises a different user's session rather than their own. Publicly available exploit code exists - the issue was disclosed through GitLab's HackerOne program - but there is no evidence of confirmed active exploitation (CISA KEV) at time of analysis.
Authenticated users who can define or modify a CI/CD configuration can achieve remote code execution on GitLab CE/EE servers by submitting a specially crafted regular expression that triggers a double free during server-side parsing. All versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 are affected; the vendor scores the issue 9.9, while our assessment retains full confidentiality and integrity impact but raises attack complexity to high because the vulnerable path is state-dependent and double-free corruption is inherently unreliable to exploit. Publicly available exploit code exists (a HackerOne report is referenced), and patches are available in 19.2.7, 19.3.3, and 19.4.1; there is no CISA KEV confirmation of active exploitation.
An authenticated GitLab EE user can read sensitive CI/CD variable values from debug-mode job traces via the Duo AI troubleshooting feature because of a missing authorization check (CWE-862). Affected versions are GitLab EE 18.7 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1. Exploitation is gated behind authentication and requires the non-default combination of CI_DEBUG_TRACE debug tracing and the Duo AI feature, and no public exploit code has been identified at time of analysis; this is a moderate-priority issue rather than a critical one.
Authenticated code execution on the GitLab server is possible in GitLab CE/EE 19.2 through 19.4.0, where an integer overflow triggered while compiling a specially crafted regular expression in a CI/CD configuration can be leveraged to run arbitrary code with the privileges of the GitLab application. The attacker must hold a GitLab account with enough project privileges to create or modify CI/CD configuration (typically Developer or higher on a project), and exploitation only occurs 'under certain conditions,' so it is not universally triggerable; the vendor-assessed vector is PR:L with scope change, and our independent assessment raises attack complexity to High (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H). Publicly available exploit code exists - a HackerOne report accompanies the fix - but there is no confirmed active exploitation (no CISA KEV listing), and instances already on 19.2.7, 19.3.3, or 19.4.1 or later are not exposed.
Dokploy instances running versions prior to 0.29.13 disclose stored Git provider secrets - GitHub App private keys, OAuth tokens and client secrets, webhook secrets, and Gitea/Bitbucket access tokens, refresh tokens, and app passwords - to authenticated organization members who were never granted access to those providers. The protected tRPC procedures github.one, gitlab.one, gitea.one, and bitbucket.one return full provider rows without applying getAccessibleGitProviderIds or an organization check, and application.one returns the same secrets as nested relations from findApplicationById even when hasGitProviderAccess is false. Exploitation requires an authenticated Dokploy account (PR:L) holding application read access or knowledge of a provider identifier, and the practical impact is confidentiality: a restricted member can use the leaked credentials to read private repositories or manipulate external CI/CD and webhook workflows. No public exploit code has been identified at time of analysis.
Unauthenticated denial of service in GitLab CE/EE (all versions from 18.4.6 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2) allows a remote attacker with no credentials to exhaust server resources through the GraphQL API by submitting queries whose true cost the complexity calculation under-counts. The flaw is an improper resource-allocation limit (CWE-770), scored CVSS 7.5 with the entire impact on availability (A:H) and none on confidentiality or integrity. Publicly available exploit code exists - a HackerOne report is linked from the advisory - but there is no CISA KEV listing, so active in-the-wild exploitation is not confirmed; EPSS data was not supplied with this record.
Insufficient scope validation in GitLab Enterprise Edition lets an authenticated user holding only Developer permissions run security policy test pipelines inside projects in their own group and read protected CI/CD variables that are meant to be restricted to Maintainer or Owner roles. All EE releases from 19.0 up to 19.1.8, 19.2.6 and 19.3.2 are affected, and GitLab shipped fixes in those patch releases. Publicly available exploit code exists (a HackerOne report is referenced), but there is no confirmed active exploitation and no CISA KEV listing.
Unauthenticated path traversal in the @zereight/mcp-gitlab Model Context Protocol server prior to version 2.1.27 allows any network-reachable attacker to read arbitrary files from the server host and exfiltrate their contents into an attacker-accessible GitLab project upload, enabling theft of the server's GITLAB_PERSONAL_ACCESS_TOKEN from /proc/self/environ and resulting in full GitLab account takeover. The exposure exists in SSE transport mode (SSE=true), which the advisory states is the default configuration for Docker deployments and which serves all MCP tools without any authentication; the assessed severity is CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). No public exploit code and no CISA KEV entry were identified at time of analysis, but the attack requires only network access to the exposed SSE port and a single call to the upload_markdown tool.
DNS rebinding against the local Streamable HTTP MCP listener in @zereight/mcp-gitlab before 2.1.30 lets a malicious web page reach a victim's loopback MCP endpoint while preserving an attacker-controlled Host and Origin, so the request is accepted at the HTTP boundary and reaches the MCP initialization path - and, where a GitLab token is configured, can drive GitLab API tool calls through the victim's browser. Exploitation is network-reachable with no attacker credentials required (CVSS PR:N) but hinges on victim interaction (UI:R): the user must browse to an attacker-controlled page while an unpatched server listens on its default 127.0.0.1 bind with no effective Host/Origin allowlist. Publicly available exploit code exists - the vendor advisory ships a proof-of-concept reproduction - and the upstream/NVD vector scores 9.6 Critical, while the independent assessment lowers availability impact to Low (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L); in REMOTE_AUTHORIZATION=true deployments, token checks block material unauthenticated GitLab API tool calls, reducing realized impact to the HTTP-boundary/initialization failure.
Server-side request forgery in the @zereight/mcp-gitlab Model Context Protocol server (npm versions 0.0.1 through 2.1.26) allows a caller who can reach the server's HTTP/SSE transport to redirect every outbound GitLab API call to an attacker-controlled host - taking the victim's Private-Token with it - by setting a crafted X-GitLab-API-URL request header. The server accepts that header only when the non-default environment variable ENABLE_DYNAMIC_API_URL=true is set, and it validates the value with a syntax-only new URL() check, applying no allowlist or hostname restriction before the token is attached to the redirected fetch. Publicly available exploit code exists, the flaw is credibly rated as a high-impact credential-theft issue (assessed CVSS 3.1 base of 9.6 with scope change, C:H/I:H), and a vendor fix is available in version 2.1.27, so exposure is limited to deployments that have enabled the dynamic-API-URL option and exposed the transport beyond localhost.
Authenticated users of GitLab CE/EE can read CI/CD variables that are scoped to environments they are not entitled to, because the environment scope pattern matcher fails to validate scope input correctly. The flaw affects all versions from 15.7 up to 19.1.7, 19.2.5, and 19.3.1, with fixes in 19.1.8, 19.2.6, and 19.3.2. Public exploit code exists (referenced via a HackerOne report), the issue carries a CVSS of 7.7 with a confidentiality-only, scope-changed profile, and there is no CISA KEV listing indicating confirmed active exploitation at time of analysis.
Authenticated remote code execution in GitLab Enterprise Edition (Advanced Search / Elasticsearch indexing) allows a user with project-import rights to overflow a Unicode conversion buffer by importing a specially crafted Git project export, resulting in arbitrary command execution on the GitLab server. All EE versions from 12.3 through 19.1.8, plus 19.2 before 19.2.6 and 19.3 before 19.3.2, are affected under configurations where Advanced Search is enabled. Publicly available exploit code exists and the HackerOne report is referenced, making this a high-priority patching target for internet- or partner-exposed GitLab EE instances, though exploitation requires an authenticated account and a non-default Elasticsearch-backed search configuration.
Unauthenticated arbitrary file read in GitLab CE/EE lets remote attackers retrieve files from the GitLab server via the repository commits API, which fails to confine paths and does not enforce authentication. All 18.7 releases through 19.3.2 are affected across the fix lines (before 19.1.8, 19.2.6, and 19.3.2). This is confirmed actively exploited (CISA KEV) and publicly available exploit code exists, making it an emergency-patch priority for any internet-reachable GitLab instance.
Sensitive credential and configuration disclosure in GitLab Enterprise Edition allows an authenticated user with Duo Chat access to exfiltrate Advanced Search (Elasticsearch) instance configurations and stored credentials by supplying a specially crafted GraphQL subscription argument that bypasses serialization and forces an internal server object lookup. It affects EE 18.3 through 19.1.8, 19.2 through 19.2.6, and 19.3 through 19.3.2, was reported by GitLab, and publicly available exploit code exists (HackerOne #4012289). No CISA KEV listing at time of analysis, so this is POC-backed but not confirmed as actively exploited.
Credential exfiltration in Renovate before 44.11.3 lets a malicious or compromised GitLab server steal the authentication tokens Renovate uses to talk to it. When Renovate follows GitLab API pagination, it trusts the server-supplied Link header without validating its destination, so an attacker-controlled server can redirect the credential-bearing follow-up request to attacker infrastructure (CWE-601 open redirect). Reported by VulnCheck with a CVSS 4.0 base score of 9.2; no public exploit identified at time of analysis and no CISA KEV listing.
Server-Side Request Forgery in Gitingest through 0.3.1 allows unauthenticated attackers to redirect outbound server connections to arbitrary attacker-controlled hosts by exploiting a prefix-only hostname validation bypass in the `_validate_host` function. Because Gitingest may carry GitHub personal access tokens as HTTP basic auth credentials on outbound git requests, any host whose name begins with `git.`, `gitlab.`, or `github.` passes validation and becomes a credential harvesting endpoint. No public exploit code is confirmed at time of analysis and no CISA KEV listing exists, but the CVSS 4.0 score of 8.3 reflects the combination of low attack complexity, unauthenticated access, and high confidentiality impact.
Server-side request forgery in the GitLab AI Gateway (Duo Agent Platform) lets an authenticated user redirect outbound model requests to an attacker-controlled endpoint by supplying a crafted inline flow configuration that overrides the HTTP Host header, exfiltrating Google Cloud Vertex service credentials and private signing keys. It affects AI Gateway 18.10 through 19.0.11, 19.1 through 19.1.6, and 19.2 through 19.2.1. Publicly available exploit code exists (HackerOne #3945100); EPSS is low at 0.19% and it is not in CISA KEV.
Server-Side Request Forgery (SSRF) in GitLab AI Gateway allows authenticated users with Duo Agent Platform access to exfiltrate Google Vertex AI or AWS Bedrock cloud service credentials by injecting a malicious endpoint into crafted model metadata, causing the gateway to proxy requests - including cloud credentials - to an attacker-controlled server. All AI Gateway releases from 18.9.0 through 19.2.2 are affected across three version branches; GitLab has confirmed remediation. A public exploit exists per the HackerOne reference, and the CVSS Scope Change metric (S:C) reflects that successful exploitation extends compromise to external cloud infrastructure beyond the GitLab instance itself.
Arbitrary CI command execution in GitLab Enterprise Edition allows an authenticated developer-role user to run unauthorized commands within a CI pipeline context across all EE versions from 18.9 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1. The root cause is CWE-829 (Inclusion of Functionality from Untrusted Control Sphere): a Claude AI agent integration within GitLab EE processes CI pipeline configuration drawn from a user-controlled source without adequate isolation, enabling instruction injection into the agent's execution context. A public proof-of-concept is confirmed via HackerOne report 3863650, though SSVC and EPSS signals indicate no observed widespread active exploitation at time of analysis.
Stack-based buffer overflow in GNOME Dia diagram editor (0.98.0 and earlier) permits stack exhaustion and potential return-address corruption when a victim opens a crafted .dia XML file containing a Bus object with an attacker-controlled bus_handles value and then moves a handle in the diagram. The root cause - an unbounded g_alloca() call driven by an unvalidated file attribute - is also present in objects/Misc/tree.c via Tree objects, widening the attack surface. No public exploit or CISA KEV listing exists at time of analysis, but the GitLab issue provides sufficient technical detail for proof-of-concept development.
Remote code execution in GitLab CE/EE package registry exposes instances across three active version branches to full host compromise by an authenticated low-privilege user. Path traversal (CWE-22) in the package registry component allows directory escape and arbitrary file write under certain server-side conditions, with CVSS scope change (S:C) confirming that impact extends beyond the GitLab application to the underlying host. A publicly available exploit exists via HackerOne report 3754194, though this vulnerability is not listed in the CISA KEV catalog at time of analysis.
GraphQL multiplex query handling in GitLab CE/EE improperly validates request methods, permitting unauthenticated attackers to trigger state-changing mutations via HTTP GET requests, effectively bypassing CSRF protections. All GitLab CE/EE deployments running versions 18.2 through the affected ranges across the 18.x, 19.0, 19.1, and 19.2 release lines are exposed. A publicly available exploit exists via HackerOne disclosure, and successful exploitation allows an attacker to perform arbitrary data-modifying operations on behalf of any authenticated GitLab user who can be lured to a malicious page.
Unauthenticated data tampering in GitLab CE/EE (18.2-18.11.10, 19.0-19.0.7, 19.1-19.1.5, 19.2-19.2.3) lets a remote attacker modify or delete public projects and user data by abusing a GraphQL directive, per CVE-2026-19478 (CVSS 9.4). The flaw was self-reported by GitLab and publicly available exploit code exists via a HackerOne disclosure, though it is not listed in CISA KEV. Impact is weighted toward integrity and availability rather than data theft (CVSS C:L/I:H/A:H).
Stored cross-site scripting in GitLab CE/EE's analytics dashboard component allows an authenticated low-privilege user to inject malicious JavaScript into table cell content that executes in the browsers of other users who view the affected dashboard. The scope change (S:C in CVSS) confirms the impact crosses security boundaries, enabling session hijacking, credential theft, or unauthorized API actions on behalf of victims including administrators. A publicly available proof-of-concept exploit exists via HackerOne report #3830478; no confirmed active exploitation in CISA KEV at time of analysis.
Stored or reflected cross-site scripting in GitLab CE/EE's analytics dashboard allows an authenticated attacker with low privileges to inject malicious scripts into pagination controls, executing in the browser context of any user who views the affected page. Affected versions span 18.2 through 19.2.1 across all three supported release trains. A publicly available proof-of-concept exists via HackerOne report 3830061; the Changed scope (S:C) and High C/I impacts elevate real-world risk significantly beyond a typical low-privilege XSS.
Privilege escalation in GitLab Enterprise Edition exposes project governance controls to any authenticated project member due to missing authorization checks on the project update API endpoint. Affecting EE versions 19.1.0 through 19.1.3 and 19.2.0 through 19.2.1, this flaw lets lower-privileged users (developers, reporters) silently overwrite project settings normally restricted to maintainers or owners - including branch protection rules, merge approval requirements, and access policies. A publicly available exploit exists via HackerOne; active exploitation is not confirmed by CISA KEV, but the low attack complexity combined with public proof-of-concept code significantly elevates operational urgency.
Improper authorization of namespace identity in GitLab Enterprise Edition 19.1.x and 19.2.x allows an authenticated low-privilege user to attribute AI feature usage to arbitrary namespaces they do not own, crossing organizational authorization boundaries within a multi-tenant deployment. The flaw, classified as CWE-639, arises because user-supplied identity information in requests is insufficiently validated before being used to authorize namespace-scoped AI operations, producing a scope change that affects namespaces beyond the attacker's own. GitLab has released patches in versions 19.1.4 and 19.2.2, and no public exploit code exists at time of analysis.
Denial of service in GitLab CE/EE (versions 18.5 through pre-19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2) allows unauthenticated remote attackers to exhaust server resources through improper input validation, rooted in CWE-770 (resource allocation without throttling limits). Exploitation is conditional - the description explicitly qualifies 'under certain conditions' - which is reinforced by SSVC classifying the attack as non-automatable despite a CVSS PR:N/AC:L rating. A publicly available proof-of-concept exists via a HackerOne disclosure, though EPSS sits at only 0.41% (34th percentile) and CISA has not listed this in the KEV catalog, suggesting exploitation remains opportunistic rather than widespread.
Improper authorization in GitLab CE/EE pipeline reference validation allows authenticated developer-role users to execute CI/CD pipelines on protected branches they lack push permissions to access, effectively bypassing branch protection policies. All GitLab versions from 19.0 through 19.2 are affected until the respective patch releases. A publicly available exploit exists via HackerOne report #3832069, though no confirmed active exploitation has been recorded in the CISA KEV catalog at time of analysis.
Stored cross-site scripting in GitLab CE/EE 19.2 before 19.2.2 lets an authenticated user holding only developer-role permissions inject unsanitized HTML that executes in the browser of a higher-privileged user who opens a CI job modal, enabling privilege escalation. Publicly available exploit code exists (HackerOne report #3880796), though EPSS is modest at 0.30% (22nd percentile) and CISA SSVC records no observed exploitation. The high CVSS 9.0 is driven by a scope change and total confidentiality/integrity/availability impact once the payload runs in a victim's session.
Authenticated command injection in Dokploy (self-hostable PaaS) versions 0.29.3 through 0.29.12 lets a low-privileged user achieve arbitrary host command execution by storing a malicious Git branch value and triggering a deployment. The branch fields (customGitBranch, branch, gitlabBranch, bitbucketBranch, giteaBranch) were left without server-side validation because the earlier fix for CVE-2026-45628 was incomplete, so attacker-controlled input flows unescaped into shell-based git clone commands. No public exploit has been identified at time of analysis, but the flaw carries a CVSS of 9.9 and is fixed in 0.29.13.
Improper attribute validation in GitLab CE/EE (18.0 through 19.0.5, 19.1 through 19.1.3, 19.2 through 19.2.1) lets an authenticated user tamper with CI/CD configuration owned by another user by injecting user-controlled attributes into pipeline schedule input processing. Publicly available exploit code exists (HackerOne #3800511), though the flaw is not listed in CISA KEV and requires authentication plus high-complexity conditions to trigger. GitLab, the reporter, has shipped fixed releases across all supported branches.
Denial of service in GitLab CE/EE (all versions from 11.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1) allows an unauthenticated attacker to exhaust server resources through insufficient throttling when the application processes merge request discussions. Vendor-reported by GitLab with no public exploit identified at time of analysis; the availability-only impact (CVSS 7.5, A:H) reflects service disruption rather than data compromise. Exploitation is conditional ('under certain conditions'), which tempers the otherwise network-reachable, no-auth attack surface.
Server-side request forgery and internal repository exfiltration in Gitea before 1.27.0 lets a low-privileged authenticated user bypass the migration URL allow/block list by supplying a permitted public Git URL that HTTP-redirects the server's git subprocess to an otherwise-blocked internal endpoint. Because Gitea validates only the originally submitted URL while git runs with its default http.followRedirects=initial, the redirected internal Git repository is cloned into an attacker-controlled repository, and pull mirrors keep re-fetching it on schedule. No public exploit identified at time of analysis; a vendor-authored local proof-of-concept confirmed the redirect is followed to 127.0.0.1, and EPSS/KEV data were not supplied.
GitLab API request redirection in zereight's mcp-gitlab (gitlab-mcp) MCP server lets attackers who control the job_id parameter escape the intended /jobs/ path prefix and reach arbitrary GitLab REST API endpoints under the operator's personal access token. Because the token is a bearer of the operator's full GitLab privileges, a crafted value such as '../../../user' resolves to /api/v4/user (or any other resource), turning a scoped job lookup into broad unauthorized data access. No public exploit was identified at time of analysis, and it is not listed in CISA KEV, but the flaw is trivially triggerable and was reported by VulnCheck with a vendor fix committed.
Credential leakage in electron-updater (the auto-update component of electron-builder / builder-util-runtime) before 9.7.0 allows an attacker controlling a redirect target to harvest update-feed credentials. The HTTP redirect handler only stripped a header keyed exactly as lowercase "authorization", so PRIVATE-TOKEN (GitLab personal access tokens) and mixed-case Authorization (GitLab Bearer/OAuth) headers were forwarded to attacker-controlled cross-origin redirect destinations. There is no public exploit identified at time of analysis, but the upstream fix is published in version 9.7.0.
Approval-gate bypass in Woodpecker CI before 3.15.0 lets an attacker who can open a merge request from a fork against a GitLab-backed repository run unapproved, attacker-controlled pipelines. Because the GitLab forge driver populates pipeline.Author from the spoofable git commit author name (commit.author.name) rather than the GitLab-validated user identity, an attacker simply sets the commit author to a name listed in ApprovalAllowedUsers, making needsApproval return false. This grants arbitrary CI step execution on a Woodpecker agent and exposure of CI secrets; there is no public exploit identified at time of analysis, but the issue was reported by VulnCheck and is trivially reproducible.
Denial of service in linkify-it (npm) through v5.0.0 lets remote unauthenticated attackers wedge a rendering worker by submitting tens of KB of repeated email/link-like text. The core public API LinkifyIt.prototype.match runs an O(N²) scan loop that re-slices the input and re-runs unanchored fuzzy regex searches once per match, so 64 KB of "a@b.com" burns ~2.5 s of single-threaded CPU and 128 KB ~10 s. The flaw is inherited by markdown-it (~21.6M weekly npm downloads) whenever linkify:true is set, exposing forums, chat, wikis and AI chat UIs; publicly available exploit code (a PoC in the GHSA advisory) exists, but there is no evidence of active exploitation.
Information disclosure in GitLab Enterprise Edition 19.1 (before 19.1.1) lets a user retrieve sensitive data previously committed to a project because Duo Workflows fails to adequately filter its output under certain conditions. The flaw exposes confidential repository content through GitLab's AI workflow feature without altering or destroying data. No public exploit is identified at time of analysis and CISA SSVC rates exploitation as 'none', though EPSS sits at a modest 0.33% (25th percentile).
Denial of service in libtiff v4.7.1 and prior allows processing of a crafted TIFF file containing an abnormally large SamplesPerPixel tag value to crash or hang the affected process. Any application or service that passes attacker-controlled TIFF files through libtiff is potentially vulnerable, including web-based image processors, document converters, and media ingestion pipelines. No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at the time of this analysis.
Improper authorization in DevGuard versions prior to v1.4.2 allows any authenticated user on the instance - including users with no membership in the target organization, project, or asset - to perform write operations on vulnerability-triage endpoints of any public asset. The flaw lets attackers create, modify, or delete VEX rules, dependency-vulnerability events, license risks, external references, and artifacts, corrupting the integrity of published vex.json/sbom.json output consumed by downstream supply-chain users. No public exploit identified at time of analysis, and EPSS probability is very low (0.04%, 11th percentile), reflecting the niche audience but not the integrity blast radius.
Account takeover in GitLab Enterprise Edition versions 15.5 through 19.0.2 allows an authenticated group Owner to hijack other group members' accounts through improper authorization in the Group SAML identity management functionality. Publicly available exploit code exists via a HackerOne report, and GitLab released patched versions 18.10.8, 18.11.5, and 19.0.2 on 2026-06-10. The flaw stems from CWE-639 (Authorization Bypass Through User-Controlled Key) and yields a scope-changing high-impact compromise per CVSS 3.1.
Denial of service in GitLab CE/EE versions 12.10 through 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 allows unauthenticated remote attackers to crash or degrade the API request parsing middleware via malformed input. Publicly available exploit code exists (HackerOne report 3671995), and the CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/A:H) reflects trivially-reachable, no-auth exploitation against any internet-exposed GitLab instance. No CISA KEV listing at time of analysis.
Stored cross-site scripting and account integrity abuse in GitLab Enterprise Edition versions 13.1.4 through 18.10.7, 18.11 prior to 18.11.5, and 19.0 prior to 19.0.2 allows an authenticated low-privileged user to inject unsanitized input into certain group setting fields and add unauthorized email addresses to a targeted user's account. Publicly available exploit code exists via a HackerOne report, though EPSS exploitation probability remains very low at 0.02% and the SSVC framework rates current exploitation as 'none' with total technical impact when successful.
Stored cross-site scripting in GitLab Enterprise Edition's Analytics Dashboard allows an authenticated developer-role user to execute arbitrary client-side JavaScript in the browser of a targeted user, leveraging improper input sanitization. The flaw affects all 17.1 through 18.10.x, 18.11.x, and 19.0.x branches before fixed releases, and publicly available exploit code exists via a HackerOne report, raising the realistic risk of opportunistic abuse against multi-tenant GitLab instances.
Identity confusion in GitLab EE's Duo AI workflow runners lets an authenticated, low-privileged user cause specific Duo AI workflows to execute under another user's identity, crossing the trust boundary between accounts (CVSS scope: changed). The flaw stems from improper user identity resolution and affects GitLab Enterprise Edition 18.8 through 18.10.6, 18.11 through 18.11.3, and 19.0, with High confidentiality and integrity impact but no availability impact. No public exploit has been identified, CISA's SSVC marks exploitation as 'none,' and the High attack complexity (AC:H) combined with the 'under certain conditions' caveat indicates exploitation is non-trivial rather than push-button.
Command injection in Prefect 3.6.18's GitHub integration allows authenticated users to execute arbitrary git commands through the unsanitized reference field. The GitHubRepository block concatenates user input directly into git clone commands, enabling attackers to inject malicious options that can lead to SSRF, credential theft, or remote code execution. While no active exploitation is confirmed, the straightforward attack vector and high impact make this a priority for organizations using Prefect's GitHub integration features.
Unauthenticated agent token theft in Coder v2 (self-hosted developer workspace platform) stems from azureidentity.Validate() verifying the PKCS#7 signer's certificate chain but skipping signature verification of the signed content itself. Remote attackers who know a target VM's vmId (a UUIDv4) can forge a PKCS#7 envelope containing a legitimate Azure certificate alongside attacker-controlled content and POST it to the unauthenticated /api/v2/workspaceagents/azure-instance-identity endpoint to receive the victim workspace agent's session token, which then unlocks Git SSH keys, OAuth tokens for GitHub/GitLab/Bitbucket, and workspace secrets. No public exploit identified at time of analysis, but the vulnerability is vendor-confirmed via GHSA-6x44-w3xg-hqqf and a detailed root-cause analysis with attack-path diagram is published.
Broken access control in Arcane's GitOps backend (versions <= 1.18.1) allows any authenticated low-privilege user to exfiltrate plaintext Git credentials (PATs/SSH keys) stored for source-of-truth repositories. Eight of nine /api/customize/git-repositories endpoints omit the checkAdmin() gate, letting a 'user' role attacker repoint a repository URL to an attacker-controlled host and trigger a /test or /branches call that transmits the decrypted token via HTTP Basic auth. No public exploit identified at time of analysis, but the GHSA advisory documents a complete attack chain and a patched release (1.19.0) is available.
Stored cross-site scripting in GitLab Enterprise Edition lets an authenticated user holding Developer-role permissions inject arbitrary JavaScript that executes in the browsers of other users who view the affected content. The flaw stems from improper input sanitization and affects all 16.4-series through 18.11.x releases prior to the 18.9.7, 18.10.6, and 18.11.3 patch releases. No public exploit identified at time of analysis, and EPSS is very low (0.02%), but CVSS is rated 8.7 because the scope-changing XSS can hijack higher-privileged user sessions.
Stored cross-site scripting in GitLab Enterprise Edition's customizable analytics dashboards allows an authenticated user to execute arbitrary JavaScript in the browsers of other users who view the affected dashboard. The flaw affects EE 18.7-18.9.6, 18.10-18.10.5, and 18.11-18.11.2, carries a CVSS 8.7 (scope-changed) rating, and a vendor patch is available. No public exploit identified at time of analysis and EPSS is very low (0.02%, 5th percentile).
Stored cross-site scripting in GitLab Enterprise Edition 18.7-18.11.x allows an authenticated user to inject arbitrary JavaScript that executes in other users' browser sessions due to improper input sanitization. The CVSS 8.7 score is elevated by Scope:Changed (S:C), reflecting that injected script can pivot across security contexts and potentially target administrators. No public exploit identified at time of analysis, EPSS is very low (0.02%, 5th percentile), and SSVC indicates no observed exploitation, but a vendor patch is available across all three affected branches.
Denial of service in GitLab CE/EE allows unauthenticated remote attackers to disrupt service availability by sending specially crafted requests that exploit insufficient input validation. Affected versions span 9.0 through 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 across both Community and Enterprise editions, with no public exploit identified at time of analysis and a low EPSS score (0.04%) indicating limited near-term exploitation likelihood despite the network-reachable attack surface.
Unauthenticated remote access to GitLab API operations via gitlab-mcp-server's SSE transport allows attackers to execute all 86 exposed GitLab management tools-including repository deletion, file modification, and configuration changes-using the operator's Personal Access Token. When configured with USE_SSE=true (a documented feature), the Node.js server binds to 0.0.0.0 with wildcard CORS headers, enabling both network-adjacent attackers and malicious web pages to invoke destructive operations without credentials. Public exploit code demonstrates the attack path from initial SSE connection through authenticated GitLab API calls. Patch version 0.6.0 addresses the authentication bypass per GitHub advisory GHSA-8jr5-6gvj-rfpf.
Cross-Site Request Forgery (CSRF) in GitLab CE/EE allows remote unauthenticated attackers to execute GraphQL mutations as authenticated victims through crafted web pages. Affects all versions from 17.0 through 18.11.0, with publicly available exploit code (HackerOne report 3627285). Despite high CVSS 8.1, exploitation requires user interaction (phishing/social engineering) and is not automatable per CISA SSVC framework. No evidence of active exploitation in CISA KEV at time of analysis. Vendor patches released: 18.9.6, 18.10.4, and 18.11.1.
Cross-site scripting vulnerability in GitLab's Storybook development environment allows remote unauthenticated attackers to steal access tokens via crafted user interaction. Affects GitLab CE/EE versions 16.1.0 through 18.9.5, 18.10 through 18.10.3, and 18.11.0. Publicly available exploit code exists (HackerOne report 3574642), though CISA SSVC indicates no confirmed active exploitation at time of analysis. CVSS 8.0 reflects high confidentiality and integrity impact with scope change, but CVSS vector AC:H (high complexity) and UI:R (user interaction required) indicate exploitation requires targeted social engineering rather than automated mass exploitation.
Cross-site scripting (XSS) in GitLab CE/EE versions 18.10.0-18.10.3 and 18.11.0 enables unauthenticated attackers to execute arbitrary JavaScript in victim browser sessions via improper path validation. GitLab disclosed this vulnerability with publicly available exploit code (HackerOne report 3572231), though CISA SSVC indicates no active exploitation confirmed at time of analysis. CVSS 8.0 reflects the changed scope (S:C) allowing impact beyond the vulnerable component, though High attack complexity (AC:H) and required user interaction (UI:R) limit ease of exploitation. Patched in versions 18.10.4 and 18.11.1.
Credential leakage in Tekton Pipelines git resolver allows authenticated users to exfiltrate system-configured Git API tokens (GitHub PAT, GitLab tokens) by directing the resolver to attacker-controlled endpoints. Affects versions 1.0.0 through 1.10.0 when users omit the token parameter in TaskRun or PipelineRun configurations. CVSS 7.7 with scope change reflects cross-tenant credential theft potential in multi-tenant Kubernetes environments. No active exploitation confirmed (not in CISA KEV), but exploitation is straightforward for authenticated cluster users with TaskRun/PipelineRun creation privileges.
Improper access control in GitLab CE/EE 16.9.6-18.10.2 enables authenticated attackers to invoke unauthorized server-side methods via websocket connections, achieving high-severity information disclosure with changed scope. Affects continuous integration/deployment platforms running vulnerable GitLab instances. Exploitation requires low-privilege authentication but no user interaction, enabling lateral information access across security boundaries.
Denial of service in GitLab CE/EE versions 12.10 through 18.8.8, 18.9 through 18.9.4, and 18.10 through 18.10.2 allows unauthenticated remote attackers to crash GitLab services via malformed JSON payloads. Improper input validation (CWE-1284) enables resource exhaustion attacks without authentication. CVSS 7.5 (High) reflects network-accessible attack with low complexity requiring no user interaction. No public exploit identified at time of analysis. EPSS data unavailable; not listed in CISA KEV.
Improper authorization in GitLab CE/EE Jira Connect integration allows authenticated users with minimal workspace permissions to steal installation credentials and impersonate the GitLab application. Affects versions 14.3 through 18.8.6, 18.9.0-18.9.2, and 18.10.0. Vendor-released patches available in versions 18.8.7, 18.9.3, and 18.10.1. High CVSS score (8.1) reflects significant confidentiality and integrity impact with low attack complexity. No public exploit identified at time of analysis, though detailed disclosure exists via HackerOne report.
Improper HTML sanitization in GitLab EE versions 15.4-18.10.1 allows authenticated users to add email addresses to arbitrary user accounts, potentially enabling account takeover or unauthorized access escalation. Public exploit code exists for this vulnerability, and no patch is currently available. Affected deployments should implement access controls to restrict user modification privileges until updates become available.
A Cross-Site Request Forgery (CSRF) vulnerability in GitLab Community Edition and Enterprise Edition allows unauthenticated attackers to execute arbitrary GraphQL mutations on behalf of authenticated users without their consent. All versions from 17.10 before 18.8.7, versions 18.9 before 18.9.3, and versions 18.10 before 18.10.1 are affected. A public proof-of-concept exploit is available via HackerOne report 3584382, significantly increasing the risk of active exploitation.
GitLab CE/EE contains a denial of service vulnerability in GraphQL request processing due to improper input validation (CWE-407). All versions from 18.5 through 18.8.6, 18.9 through 18.9.2, and 18.10 before 18.10.1 are affected. An unauthenticated attacker can remotely exploit this with low complexity to render GitLab instances unresponsive, and a public proof-of-concept exploit is available via HackerOne report 3597342.
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.6 versions up to 18.7.6 is affected by cross-site scripting (xss) (CVSS 8.7).
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.9 versions up to 18.9.2 is affected by uncontrolled recursion (CVSS 7.5).
Gitlab versions up to 18.7.5 is affected by allocation of resources without limits or throttling (CVSS 7.5).
Gitlab versions up to 18.7.5 is affected by inefficient regular expression complexity (redos) (CVSS 7.5).