# Recurrence Study, Complete Dataset *Every publicly disclosed vulnerability from the n8n and GitLab recurrence study, grouped into the root cause class it belongs to. For each class, Root cause is the design decision that produced the family, and Prevent is the commit-time rule that would stop it recurring. Every identifier and fix commit is a public link.* **How to read this.** n8n covers 135 GitHub Security Advisories (April 2025 to July 2026). GitLab covers 434 CVEs (January 2024 to July 2026). A finding is placed in a class only when a single fix, at one shared point in the code, would have prevented every member of that class. Uncertain findings were dropped rather than counted, so every count is a lower bound. **Data notes.** The n8n identifiers, titles and commits come directly from n8n's own public advisories. The GitLab class assignments and CVE to commit mappings are derived from public CVEs and public commits and should be treated as research, not as an official GitLab record. Nine GitLab CVEs have no public fix commit and are shown as not publicly recorded. GitLab CVE pages disclosed in 2026 may not yet be fully populated on the National Vulnerability Database. --- ## n8n 135 disclosed vulnerabilities, grouped into 32 root cause classes (23 recurring, 9 singletons). Recurrence rate 67% (90 of 135). Classes are ordered largest first. ### n1. Workflow-authored content rendered on n8n's own trusted origin without a universal neutralization boundary *recurring, 14 findings* **Root cause.** Webhook responses, binary-data responses, and node-generated pages (Form/Chat Trigger) serve author-controlled bytes from the app's own origin, and the anti-XSS defenses (sandbox CSP + output sanitization/encoding) were bolted on per-codepath instead of enforced once at the response boundary, so every new/divergent render path (legacy webhook path, binary path, per-node template, content-type edge case) re-opened the class. **Prevent.** No code path may write an HTTP response body containing author/user-controlled HTML from n8n's origin, nor render such HTML in a same-origin iframe, unless the opaque sandbox CSP (or iframe sandbox attribute) is applied by a shared boundary the path cannot bypass. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2025-04-22 | [GHSA-c8hm-hr8h-5xjw](https://github.com/n8n-io/n8n/security/advisories/GHSA-c8hm-hr8h-5xjw) | Medium | Stored XSS through Attachments View Endpoint | [`11a36b75`](https://github.com/n8n-io/n8n/commit/11a36b758df38e16a2c2c258628bf58a030a12d7) | | 2025-06-18 | [GHSA-hfmv-hhh3-43f2](https://github.com/n8n-io/n8n/security/advisories/GHSA-hfmv-hhh3-43f2) | High | Stored XSS in n8n Form Trigger allows Account Takeover via injected iframe and video/source | [`759e5559`](https://github.com/n8n-io/n8n/commit/759e5559931779a2adb8a6c47e85947fac09950a) | | 2025-08-11 | [GHSA-mvh4-2cm2-6hpg](https://github.com/n8n-io/n8n/security/advisories/GHSA-mvh4-2cm2-6hpg) | Medium | Stored XSS in n8n LangChain Chat Trigger Node via initialMessages Parameter | [`d4ef191b`](https://github.com/n8n-io/n8n/commit/d4ef191be0b39b65efa68559a3b8d5dad2e102b2) | | 2025-09-29 | [GHSA-58jc-rcg5-95f3](https://github.com/n8n-io/n8n/security/advisories/GHSA-58jc-rcg5-95f3) | High | Possible Stored XSS in “Respond to Webhook” Node May Execute Outside Sandbox | [`68e00955`](https://github.com/n8n-io/n8n/commit/68e00955ec6e35987ec7b6cce964ecdeab2cfef4) | | 2025-12-04 | [GHSA-825q-w924-xhgx](https://github.com/n8n-io/n8n/security/advisories/GHSA-825q-w924-xhgx) | High | Improper CSP Enforcement in Webhook Responses May Allow Stored XSS | [`553b2445`](https://github.com/n8n-io/n8n/commit/553b24458ea780dc4e5d63b2db51fb5466ea13ea) | | 2026-02-25 | [GHSA-2p9h-rqjw-gm92](https://github.com/n8n-io/n8n/security/advisories/GHSA-2p9h-rqjw-gm92) | High | Stored XSS via Various Nodes | [`562d8674`](https://github.com/n8n-io/n8n/commit/562d867483e871b0f1e31776252e23bd721df75b) | | 2026-03-06 | [GHSA-w673-8fjw-457c](https://github.com/n8n-io/n8n/security/advisories/GHSA-w673-8fjw-457c) | Medium | XSS and Open Redirect in Form Node | [`f1a074f9`](https://github.com/n8n-io/n8n/commit/f1a074f9469bc8e31e3c212111504e448e0acfb4) | | 2026-03-09 | [GHSA-q4fm-pjq6-m63g](https://github.com/n8n-io/n8n/security/advisories/GHSA-q4fm-pjq6-m63g) | Medium | Stored XSS in Form Trigger | [`6f2f384f`](https://github.com/n8n-io/n8n/commit/6f2f384f39a043a27fadfedb60778c748345486a) | | 2026-03-25 | [GHSA-3c7f-5hgj-h279](https://github.com/n8n-io/n8n/security/advisories/GHSA-3c7f-5hgj-h279) | Medium | XSS in Chat Trigger Node via Custom CSS | [`2d9a2ec7`](https://github.com/n8n-io/n8n/commit/2d9a2ec76e180b54e8091e31b1e0638c909abd99) | | 2026-03-25 | [GHSA-qfc3-hm4j-7q77](https://github.com/n8n-io/n8n/security/advisories/GHSA-qfc3-hm4j-7q77) | Medium | XSS via Binary Data Inline HTML Rendering | [`2d9a2ec7`](https://github.com/n8n-io/n8n/commit/2d9a2ec76e180b54e8091e31b1e0638c909abd99) | | 2026-06-02 | [GHSA-h86q-fx34-gfjr](https://github.com/n8n-io/n8n/security/advisories/GHSA-h86q-fx34-gfjr) | Medium | Reflected XSS via Facebook, WhatsApp, and Microsoft Teams Trigger Webhook Verification Endpoints | [`16728b30`](https://github.com/n8n-io/n8n/commit/16728b301cf4c300b3ef61405bd23e16a170c87b) | | 2026-06-10 | [GHSA-42h7-m79w-wvg5](https://github.com/n8n-io/n8n/security/advisories/GHSA-42h7-m79w-wvg5) | High | Stored XSS in Chat Trigger Node | [`71262655`](https://github.com/n8n-io/n8n/commit/71262655e46f2f78a4a15c58661226762f83365c) | | 2026-06-10 | [GHSA-v733-mwr6-fgcm](https://github.com/n8n-io/n8n/security/advisories/GHSA-v733-mwr6-fgcm) | High | Same-Origin XSS in Respond to Webhook Node | [`71262655`](https://github.com/n8n-io/n8n/commit/71262655e46f2f78a4a15c58661226762f83365c) | | 2026-07-08 | [GHSA-p3rg-hrf9-w9gj](https://github.com/n8n-io/n8n/security/advisories/GHSA-p3rg-hrf9-w9gj) | High | DOM-Based XSS via Unsandboxed iframe srcdoc in HTML Preview | [`46c1a0e8`](https://github.com/n8n-io/n8n/commit/46c1a0e8f32db71c79ec4187f75d2184053f1dad) | ### n2. SQL built by concatenating structural/unbound tokens (identifiers, operators, ORDER BY, LIMIT, casts) with no shared safe-construction primitive *recurring, 10 findings* **Root cause.** DB integration nodes and n8n's own data-table/source-control DDL build SQL by string-interpolating structural fields (table/column/update-key names, WHERE operator, sort direction, LIMIT, cast type) and expression-resolved values, parameterizing only data values, because there is no mandated identifier-escaping / value-binding / allowlist primitive shared across every SQL-emitting site. **Prevent.** No untrusted or expression-derived value may reach a SQL/DDL string except through parameter binding (data) or the shared identifier-escaping/allowlist primitive (identifiers, operators, limits); a raw ${...} interpolation into SQL fails review. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2026-01-12 | [GHSA-f3f2-mcxc-pwjx](https://github.com/n8n-io/n8n/security/advisories/GHSA-f3f2-mcxc-pwjx) | Medium | SQL Injection in MySQL, PostgreSQL, and Microsoft SQL nodes | [`f73fae6f`](https://github.com/n8n-io/n8n/commit/f73fae6fe7fc34907bba102648a9997186aa4385) | | 2026-03-19 | [GHSA-98c2-4cr3-4jc3](https://github.com/n8n-io/n8n/security/advisories/GHSA-98c2-4cr3-4jc3) | High | SQL Injection in Data Table Node via orderByColumn Expression | [`2d9a2ec7`](https://github.com/n8n-io/n8n/commit/2d9a2ec76e180b54e8091e31b1e0638c909abd99) | | 2026-04-22 | [GHSA-hp3c-vfpm-q4f7](https://github.com/n8n-io/n8n/security/advisories/GHSA-hp3c-vfpm-q4f7) | Medium | SQL Injection in Snowflake and MySQL Nodes | [`85b77964`](https://github.com/n8n-io/n8n/commit/85b7796434df7e80c4023666e2c0ede6e526a6ba) | | 2026-04-22 | [GHSA-mp4j-h6gh-f6mp](https://github.com/n8n-io/n8n/security/advisories/GHSA-mp4j-h6gh-f6mp) | Medium | SQL Injection in SeaTable Node | [`85b77964`](https://github.com/n8n-io/n8n/commit/85b7796434df7e80c4023666e2c0ede6e526a6ba) | | 2026-04-22 | [GHSA-r6jc-mpqw-m755](https://github.com/n8n-io/n8n/security/advisories/GHSA-r6jc-mpqw-m755) | Medium | SQL Injection in Oracle Database Node via Limit Field | [`85b77964`](https://github.com/n8n-io/n8n/commit/85b7796434df7e80c4023666e2c0ede6e526a6ba) | | 2026-05-13 | [GHSA-mhrx-qhrj-673w](https://github.com/n8n-io/n8n/security/advisories/GHSA-mhrx-qhrj-673w) | High | Source Control Pull SQL Injection | [`293d5afd`](https://github.com/n8n-io/n8n/commit/293d5afd643f2a6df6195073beed314679399290) | | 2026-06-10 | [GHSA-c37g-w77q-m4vp](https://github.com/n8n-io/n8n/security/advisories/GHSA-c37g-w77q-m4vp) | Medium | SQL Injection in Postgres v1/TimescaleDB Nodes | [`71262655`](https://github.com/n8n-io/n8n/commit/71262655e46f2f78a4a15c58661226762f83365c) | | 2026-06-24 | [GHSA-hwmj-qg4v-cvg9](https://github.com/n8n-io/n8n/security/advisories/GHSA-hwmj-qg4v-cvg9) | Medium | MySQL v1 Node executeQuery Operation Allows SQL Injection via Unparameterized Expression Interpolation | [`a4bc50f9`](https://github.com/n8n-io/n8n/commit/a4bc50f9a0633d0fb63b0ef1e4a4fd8e0fe7f34b) | | 2026-07-22 | [GHSA-652q-gvq3-74qv](https://github.com/n8n-io/n8n/security/advisories/GHSA-652q-gvq3-74qv) | Medium | Snowflake Node executeQuery Operation Allows SQL Injection via Unparameterized Expression Interpolation | [`2222fe3a`](https://github.com/n8n-io/n8n/commit/2222fe3a6c886a9059f28e1b6d4bdb10ee420624) | | 2026-07-22 | [GHSA-jqwr-vx3p-r266](https://github.com/n8n-io/n8n/security/advisories/GHSA-jqwr-vx3p-r266) | Medium | PostgresTrigger Node SQL Injection Allows Authenticated Users to Execute Arbitrary SQL on Connected PostgreSQL Instances | [`46bb1120`](https://github.com/n8n-io/n8n/commit/46bb112046a2996344cec5d01110ff2a0ef38a62) | ### n3. No prototype-safe object-construction primitive; untrusted keys written into prototype-inheriting objects via dynamic bracket assignment *recurring, 9 findings* **Root cause.** Across parsers, caches, accumulators and clone/merge helpers, code builds plain `{}` objects and writes attacker-controlled key names into them with dynamic bracket assignment (or lodash set / xml2js name mapping), with no mandated null-prototype container or setSafeObjectProperty denylist, so `__proto__`/`constructor`/`prototype` keys reach Object.prototype. **Prevent.** No object may be indexed/assigned with an untrusted key name unless the target is a null-prototype object or the write goes through the shared safe-set primitive that drops __proto__/constructor/prototype; parser name-mapping onto plain objects must run a name sanitizer. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2026-03-25 | [GHSA-mxrg-77hm-89hv](https://github.com/n8n-io/n8n/security/advisories/GHSA-mxrg-77hm-89hv) | Critical | Prototype Pollution in GSuiteAdmin node parameters leads to RCE | [`2d9a2ec7`](https://github.com/n8n-io/n8n/commit/2d9a2ec76e180b54e8091e31b1e0638c909abd99) | | 2026-04-22 | [GHSA-hqr4-h3xv-9m3r](https://github.com/n8n-io/n8n/security/advisories/GHSA-hqr4-h3xv-9m3r) | Critical | XML Node Prototype Pollution to RCE | [`85b77964`](https://github.com/n8n-io/n8n/commit/85b7796434df7e80c4023666e2c0ede6e526a6ba) | | 2026-04-22 | [GHSA-q5f4-99jv-pgg5](https://github.com/n8n-io/n8n/security/advisories/GHSA-q5f4-99jv-pgg5) | Critical | Prototype Pollution in XML Webhook Body Parser Leads to RCE | [`85b77964`](https://github.com/n8n-io/n8n/commit/85b7796434df7e80c4023666e2c0ede6e526a6ba) | | 2026-05-13 | [GHSA-c8xv-5998-g76h](https://github.com/n8n-io/n8n/security/advisories/GHSA-c8xv-5998-g76h) | Critical | HTTP Request Node Pagination Prototype Pollution to RCE | [`293d5afd`](https://github.com/n8n-io/n8n/commit/293d5afd643f2a6df6195073beed314679399290) | | 2026-05-13 | [GHSA-wrwr-h859-xh2r](https://github.com/n8n-io/n8n/security/advisories/GHSA-wrwr-h859-xh2r) | Critical | XML Node Prototype Pollution Patch Bypass | [`293d5afd`](https://github.com/n8n-io/n8n/commit/293d5afd643f2a6df6195073beed314679399290) | | 2026-06-02 | [GHSA-x6p3-m6h9-fx7r](https://github.com/n8n-io/n8n/security/advisories/GHSA-x6p3-m6h9-fx7r) | High | Microsoft SQL Node Prototype Pollution | [`dd4b3ff4`](https://github.com/n8n-io/n8n/commit/dd4b3ff4462b82f951cec9892f8a71a530abb307) | | 2026-06-10 | [GHSA-2vff-hj5x-8gq7](https://github.com/n8n-io/n8n/security/advisories/GHSA-2vff-hj5x-8gq7) | Medium | Prototype Pollution enables confused-deputy execution via public webhooks | [`71262655`](https://github.com/n8n-io/n8n/commit/71262655e46f2f78a4a15c58661226762f83365c) | | 2026-06-24 | [GHSA-75qm-gp28-rcq9](https://github.com/n8n-io/n8n/security/advisories/GHSA-75qm-gp28-rcq9) | High | Prototype Pollution via Workflow Credentials Leads to Unauthenticated User and Project Enumeration | [`a4bc50f9`](https://github.com/n8n-io/n8n/commit/a4bc50f9a0633d0fb63b0ef1e4a4fd8e0fe7f34b) | | 2026-07-22 | [GHSA-xwx6-jjhv-84p8](https://github.com/n8n-io/n8n/security/advisories/GHSA-xwx6-jjhv-84p8) | High | Prototype Pollution via Dot-Notation Field Names Leads To Instance-Wide Denial of Service | [`2222fe3a`](https://github.com/n8n-io/n8n/commit/2222fe3a6c886a9059f28e1b6d4bdb10ee420624) | ### n4. Credential / external-secret authorization enforced at the wrong altitude, bypassable via an equivalent uncovered path *recurring, 8 findings* **Root cause.** Credential-access and external-secret ($secrets) authorization checks were wired into one codepath (the editor REST controller, a resolution-time ownership check, or a pre-execution optimization keyed on a literal cred type) while semantically-equivalent paths — public API, inline sub-workflows, name-based resolution, expression-typed credential types, dynamic-node-params, and credential save-time — reached the credential/secret without the check. **Prevent.** Credential decryption/use and external-secret resolution must be authorized against the acting user at a chokepoint common to ALL entry paths (execution, save, public API, inline sub-workflows, dynamic params); an authz check placed on only one of several equivalent paths fails review. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2026-02-06 | [GHSA-fxcw-h3qj-8m8p](https://github.com/n8n-io/n8n/security/advisories/GHSA-fxcw-h3qj-8m8p) | High | External Secrets Authorization Bypass in Credential Saving | [`2b73ce42`](https://github.com/n8n-io/n8n/commit/2b73ce4288d4bbb57ee20ddffcf3a5015895890b) | | 2026-03-25 | [GHSA-m63j-689w-3j35](https://github.com/n8n-io/n8n/security/advisories/GHSA-m63j-689w-3j35) | High | Credential Theft via Name-Based Resolution and Permission Checker Bypass in Community Edition | [`2d9a2ec7`](https://github.com/n8n-io/n8n/commit/2d9a2ec76e180b54e8091e31b1e0638c909abd99) | | 2026-04-21 | [GHSA-r4v6-9fqc-w5jr](https://github.com/n8n-io/n8n/security/advisories/GHSA-r4v6-9fqc-w5jr) | High | Credential Authorization Bypass in dynamic-node-parameters Allows Foreign API Key Replay | [`ac411127`](https://github.com/n8n-io/n8n/commit/ac411127314921aaf82b7b97d76eeaa2703b708c) | | 2026-06-10 | [GHSA-pmqw-72cg-wx85](https://github.com/n8n-io/n8n/security/advisories/GHSA-pmqw-72cg-wx85) | High | Credential Exfiltration via Permission Bypass | [`71262655`](https://github.com/n8n-io/n8n/commit/71262655e46f2f78a4a15c58661226762f83365c) | | 2026-06-24 | [GHSA-2434-3x6q-8r99](https://github.com/n8n-io/n8n/security/advisories/GHSA-2434-3x6q-8r99) | Medium | External Secrets Accessible via Workflow Expressions Outside Credentials | [`a4bc50f9`](https://github.com/n8n-io/n8n/commit/a4bc50f9a0633d0fb63b0ef1e4a4fd8e0fe7f34b) | | 2026-06-24 | [GHSA-jp7m-xcgx-57qm](https://github.com/n8n-io/n8n/security/advisories/GHSA-jp7m-xcgx-57qm) | Medium | External Secrets Permission Bypass via Expression Parser Mismatch | [`a4bc50f9`](https://github.com/n8n-io/n8n/commit/a4bc50f9a0633d0fb63b0ef1e4a4fd8e0fe7f34b) | | 2026-07-22 | [GHSA-6qc9-mqvw-jg7x](https://github.com/n8n-io/n8n/security/advisories/GHSA-6qc9-mqvw-jg7x) | High | Credential Authorization Bypass via Expression in HTTP Request Node `genericAuthType` | [`2222fe3a`](https://github.com/n8n-io/n8n/commit/2222fe3a6c886a9059f28e1b6d4bdb10ee420624) | | 2026-07-22 | [GHSA-cj9h-qx8g-pq2g](https://github.com/n8n-io/n8n/security/advisories/GHSA-cj9h-qx8g-pq2g) | High | Shared-Workflow Editor Can Exfiltrate Credentials via Inline Sub-Workflow JSON | [`2222fe3a`](https://github.com/n8n-io/n8n/commit/2222fe3a6c886a9059f28e1b6d4bdb10ee420624) | ### n5. n8n file-access sandbox (isFilePathBlocked/resolvePath) incomplete or bypassed at filesystem-capable node operands *recurring, 8 findings* **Root cause.** n8n has a single file-access guard (resolvePath + isFilePathBlocked over RESTRICT_FILE_ACCESS_TO / blocked patterns) living in the core FileSystem helper, but it was (a) lexically incomplete (no symlink canonicalization / TOCTOU-safe placement / .git denylist) and (b) not called by every node/operand that touches the filesystem, so nodes doing their own fs/spawn reached the disk unchecked. **Prevent.** No node may pass an author-controlled path to a filesystem read/write/spawn syscall without first routing it through the shared realpath-canonicalizing isFilePathBlocked guard; adding a new fs-touching operand requires wiring that guard. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2025-08-04 | [GHSA-ggjm-f3g4-rwmm](https://github.com/n8n-io/n8n/security/advisories/GHSA-ggjm-f3g4-rwmm) | Medium | Symlink traversal vulnerability in "Read/Write File" node allows access to restricted files | [`c2c3e08c`](https://github.com/n8n-io/n8n/commit/c2c3e08cdf33570d9051e659812cbfbdd3c077fd) | | 2025-11-26 | [GHSA-v364-rw7m-3263](https://github.com/n8n-io/n8n/security/advisories/GHSA-v364-rw7m-3263) | Critical | RCE via Arbitrary File Write | [`a49b179e`](https://github.com/n8n-io/n8n/commit/a49b179e891c0b3501b6784c82af72b5a8c5a02d) | | 2025-12-22 | [GHSA-x2mw-7j39-93xq](https://github.com/n8n-io/n8n/security/advisories/GHSA-x2mw-7j39-93xq) | Critical | Arbitrary Command Execution via File Write and Git Operations | [`e22acaab`](https://github.com/n8n-io/n8n/commit/e22acaab3dcb2004e5fe0bf9ef2db975bde61866) | | 2026-01-20 | [GHSA-gfvg-qv54-r4pc](https://github.com/n8n-io/n8n/security/advisories/GHSA-gfvg-qv54-r4pc) | Critical | Improper File Access Controls Allow Arbitrary File Read by Authenticated Users | [`fa6ad9ce`](https://github.com/n8n-io/n8n/commit/fa6ad9ced291db10728b3591fa8576608d2a65d1) | | 2026-05-05 | [GHSA-2vx9-7wpg-88jq](https://github.com/n8n-io/n8n/security/advisories/GHSA-2vx9-7wpg-88jq) | Medium | Legacy ExecuteWorkflow Node Bypassed File Path Restrictions | [`7277566c`](https://github.com/n8n-io/n8n/commit/7277566c64c36f5e43c17a2e620da2408ab1dcb7) | | 2026-05-27 | [GHSA-5xp3-2w67-427v](https://github.com/n8n-io/n8n/security/advisories/GHSA-5xp3-2w67-427v) | Medium | Git Node Clone and Push Operations Bypass File Sandbox | [`d4f92238`](https://github.com/n8n-io/n8n/commit/d4f9223842f0584579639647e047a0f4e78a2259) | | 2026-07-08 | [GHSA-g3r5-9h93-4j2c](https://github.com/n8n-io/n8n/security/advisories/GHSA-g3r5-9h93-4j2c) | High | Race Condition in Git Clone Node Allows Authenticated Users to Achieve Remote Code Execution | [`46c1a0e8`](https://github.com/n8n-io/n8n/commit/46c1a0e8f32db71c79ec4187f75d2184053f1dad) | | 2026-07-22 | [GHSA-gf29-4f56-r2jf](https://github.com/n8n-io/n8n/security/advisories/GHSA-gf29-4f56-r2jf) | High | Git Node fetch/pull/pushTags Operations Bypass Sandbox Path Restriction | [`2222fe3a`](https://github.com/n8n-io/n8n/commit/2222fe3a6c886a9059f28e1b6d4bdb10ee420624) | ### n6. Outbound HTTP not funnelled through one egress/domain-restriction guard *recurring, 8 findings* **Root cause.** The credential 'Allowed HTTP Request Domains' restriction and the SSRF egress filter are enforced opt-in inside the imperative HTTP Request node helper, so any surface that builds its own request pipeline (RoutingNode/declarative, GraphQL, AI/LLM nodes, agent MCP connector, MCP Client transport, per-node URL threading, dynamic-node-params routing) reaches the network without consulting them. **Prevent.** No node or service may issue an outbound HTTP request carrying a credential (or reachable from workflow input) without the request URL and every redirect hop being validated by the central egress guard; bespoke fetch/undici transports must accept and honor the injected egress filter. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2025-11-18 | [GHSA-2xcx-75h9-vr9h](https://github.com/n8n-io/n8n/security/advisories/GHSA-2xcx-75h9-vr9h) | Medium | Domain allowlist bypass enables credential exfiltration | [`404640f1`](https://github.com/n8n-io/n8n/commit/404640f1e93fe848ec4b90e972a1ea53e33f80e2) | | 2026-05-05 | [GHSA-3875-8gcx-7v46](https://github.com/n8n-io/n8n/security/advisories/GHSA-3875-8gcx-7v46) | Medium | Credential exfiltration via Allowed HTTP Request Domains Bypass | [`8551b1b9`](https://github.com/n8n-io/n8n/commit/8551b1b90ce16b31a017bd07177694ef39ad226d) | | 2026-06-09 | [GHSA-rm2v-h48j-895m](https://github.com/n8n-io/n8n/security/advisories/GHSA-rm2v-h48j-895m) | High | SecurityScorecard Node Leaks API Token to User-Controlled Host | [`71262655`](https://github.com/n8n-io/n8n/commit/71262655e46f2f78a4a15c58661226762f83365c) | | 2026-06-24 | [GHSA-h44j-f5r5-ph73](https://github.com/n8n-io/n8n/security/advisories/GHSA-h44j-f5r5-ph73) | High | "Allowed HTTP Request Domains" Restriction Bypass via AI Agents MCP Connector | [`a4bc50f9`](https://github.com/n8n-io/n8n/commit/a4bc50f9a0633d0fb63b0ef1e4a4fd8e0fe7f34b) | | 2026-07-08 | [GHSA-9w78-79q7-r4fp](https://github.com/n8n-io/n8n/security/advisories/GHSA-9w78-79q7-r4fp) | Medium | Authenticated SSRF via Dynamic Node Parameters Endpoints Allows Internal Network Access | [`46c1a0e8`](https://github.com/n8n-io/n8n/commit/46c1a0e8f32db71c79ec4187f75d2184053f1dad) | | 2026-07-08 | [GHSA-gq66-9cw5-j5jm](https://github.com/n8n-io/n8n/security/advisories/GHSA-gq66-9cw5-j5jm) | Medium | GraphQL Node Bypasses "Allowed HTTP Request Domains" Restriction | [`46c1a0e8`](https://github.com/n8n-io/n8n/commit/46c1a0e8f32db71c79ec4187f75d2184053f1dad) | | 2026-07-22 | [GHSA-64xh-79j6-r5v8](https://github.com/n8n-io/n8n/security/advisories/GHSA-64xh-79j6-r5v8) | High | Bypass "Allowed HTTP Request Domains" Credential Restriction in Multiple AI and LLM Nodes | [`2222fe3a`](https://github.com/n8n-io/n8n/commit/2222fe3a6c886a9059f28e1b6d4bdb10ee420624) | | 2026-07-22 | [GHSA-vhf8-cg2h-cg3p](https://github.com/n8n-io/n8n/security/advisories/GHSA-vhf8-cg2h-cg3p) | Medium | SSRF Protection Bypass via MCP Client Node | [`2222fe3a`](https://github.com/n8n-io/n8n/commit/2222fe3a6c886a9059f28e1b6d4bdb10ee420624) | ### n7. Workflow expression evaluation sandbox mediates untrusted expressions by incomplete AST/accessor enumeration *recurring, 6 findings* **Root cause.** n8n evaluates untrusted workflow expressions in-process (Tournament/legacy AST-rewriting sandbox over a shared JS realm, and the isolated-vm host-bridge) where safety depends on enumerating every dangerous syntactic form / rebinding `this` / guarding every host accessor; any un-enumerated construct (function-expression this, spreads, reserved-name shadowing, `with`, arrow bodies, callee, an unguarded host accessor) leaks a real global -> RCE/pollution. **Prevent.** Expression-sandbox safety must not rest on an enumerate-the-bad denylist or on one of several parallel accessors carrying a guard; every AST context and every host bridge accessor must route through the same complete mediation, and adding a new accessor/AST case requires proving it cannot reach a host global. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2025-11-19 | [GHSA-v98v-ff95-f3cp](https://github.com/n8n-io/n8n/security/advisories/GHSA-v98v-ff95-f3cp) | Critical | n8n Remote Code Execution via Expression Injection | [`08f33201`](https://github.com/n8n-io/n8n/commit/08f332015153decdda3c37ad4fcb9f7ba13a7c79) | | 2026-01-23 | [GHSA-6cqr-8cfr-67f8](https://github.com/n8n-io/n8n/security/advisories/GHSA-6cqr-8cfr-67f8) | Critical | Expression Escape Vulnerability Leading to RCE | [`efc6c123`](https://github.com/n8n-io/n8n/commit/efc6c123c848a7e1df74effabf30a3f3cf9d1a8f) | | 2026-02-25 | [GHSA-vpcf-gvg4-6qwr](https://github.com/n8n-io/n8n/security/advisories/GHSA-vpcf-gvg4-6qwr) | Critical | Expression Sandbox Escape Leading to RCE | [`562d8674`](https://github.com/n8n-io/n8n/commit/562d867483e871b0f1e31776252e23bd721df75b) | | 2026-07-08 | [GHSA-pm35-fqvh-cq5g](https://github.com/n8n-io/n8n/security/advisories/GHSA-pm35-fqvh-cq5g) | High | Legacy Expression Evaluator Sanitizer Bypass Leads to Authenticated Code Execution | [`46c1a0e8`](https://github.com/n8n-io/n8n/commit/46c1a0e8f32db71c79ec4187f75d2184053f1dad) | | 2026-07-22 | [GHSA-gv7g-jm28-cr3m](https://github.com/n8n-io/n8n/security/advisories/GHSA-gv7g-jm28-cr3m) | High | Expression sandbox escape via arrow-function bodies enabling command execution | [`2222fe3a`](https://github.com/n8n-io/n8n/commit/2222fe3a6c886a9059f28e1b6d4bdb10ee420624) | | 2026-07-22 | [GHSA-hx4h-vr3m-45vh](https://github.com/n8n-io/n8n/security/advisories/GHSA-hx4h-vr3m-45vh) | Medium | Prototype Pollution via VM Expression Engine Sandbox Escape Leads to Denial of Service | [`2222fe3a`](https://github.com/n8n-io/n8n/commit/2222fe3a6c886a9059f28e1b6d4bdb10ee420624) | ### n8. editor-ui flows persisted/attacker-influenced URLs and HTML into DOM navigation/render sinks without a shared safe-output primitive *recurring, 6 findings* **Root cause.** The frontend passes attacker-influenced strings (OAuth authUrl, resource-locator cachedResultUrl, MCP client_name, markdown attributes, login redirect) into DOM navigation/render sinks (window.open, href, innerHTML/dangerouslyUseHTMLString, location) validated by ad-hoc per-site string checks (startsWith, a mis-anchored regex, unquoted attribute emission) rather than one shared safe-URL/safe-HTML primitive. **Prevent.** No editor-ui code may pass a non-constant URL to a navigation sink without the shared scheme+origin allowlist, nor emit an attacker-influenced value into HTML without the shared safe-attribute serializer; per-call startsWith/regex URL checks fail review. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2025-06-11 | [GHSA-5vj6-wjr7-5v9f](https://github.com/n8n-io/n8n/security/advisories/GHSA-5vj6-wjr7-5v9f) | Medium | Open Redirect Vulnerability in n8n Login Flow | [`4865d1e3`](https://github.com/n8n-io/n8n/commit/4865d1e360a0fe7b045e295b5e1a29daad12314e) | | 2025-12-23 | [GHSA-qpq4-pw7f-pp8w](https://github.com/n8n-io/n8n/security/advisories/GHSA-qpq4-pw7f-pp8w) | High | Stored Cross-Site Scripting via Markdown Rendering in Workflow UI | [`3b9203e9`](https://github.com/n8n-io/n8n/commit/3b9203e9f5d7e6b8269c12cfe08780a5d30d12b4) | | 2026-02-06 | [GHSA-364x-8g5j-x2pr](https://github.com/n8n-io/n8n/security/advisories/GHSA-364x-8g5j-x2pr) | Medium | XSS in Credential Management Flow | [`e1a1e870`](https://github.com/n8n-io/n8n/commit/e1a1e8700171c1e9bcb853be21be2e2c245118ea) | | 2026-04-22 | [GHSA-537j-gqpc-p7fq](https://github.com/n8n-io/n8n/security/advisories/GHSA-537j-gqpc-p7fq) | High | XSS via MCP OAuth client | [`85b77964`](https://github.com/n8n-io/n8n/commit/85b7796434df7e80c4023666e2c0ede6e526a6ba) | | 2026-04-22 | [GHSA-f6x8-65q6-j9m9](https://github.com/n8n-io/n8n/security/advisories/GHSA-f6x8-65q6-j9m9) | Medium | Open Redirect in MCP OAuth Consent Flow | [`85b77964`](https://github.com/n8n-io/n8n/commit/85b7796434df7e80c4023666e2c0ede6e526a6ba) | | 2026-07-08 | [GHSA-9wcp-9r3j-383q](https://github.com/n8n-io/n8n/security/advisories/GHSA-9wcp-9r3j-383q) | High | Stored DOM XSS via Resource Locator `cachedResultUrl` | [`46c1a0e8`](https://github.com/n8n-io/n8n/commit/46c1a0e8f32db71c79ec4187f75d2184053f1dad) | ### n9. Resource resolved by raw id with no per-user object-level (BOLA/IDOR) authorization *recurring, 6 findings* **Root cause.** Endpoints (OAuth callback/reconnect, dynamic-credential EE, public-API variables, MCP-trigger consent, agent tools) fetch the target workflow/credential/variable by raw id via unscoped finders, authenticating the caller but never checking the caller's ownership/scope on the specific object, because the shared resource abstractions modeled no per-user authorize(). **Prevent.** No handler may act on a resource fetched by client-supplied id without a per-user object-level authorization check (ownership or the required scope on THAT object); raw repository get-by-id in a request path is forbidden. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2026-02-10 | [GHSA-vpgc-2f6g-7w7x](https://github.com/n8n-io/n8n/security/advisories/GHSA-vpgc-2f6g-7w7x) | Medium | Authorization Bypass in OAuth Callback via N8N_SKIP_AUTH_ON_OAUTH_CALLBACK | [`7108ef45`](https://github.com/n8n-io/n8n/commit/7108ef45fad8e1b131767a80237ff6b212c4fade) | | 2026-04-22 | [GHSA-756q-gq9h-fp22](https://github.com/n8n-io/n8n/security/advisories/GHSA-756q-gq9h-fp22) | Medium | Public API Variables IDOR Allows Cross-Project Secret Disclosure | [`2d9a2ec7`](https://github.com/n8n-io/n8n/commit/2d9a2ec76e180b54e8091e31b1e0638c909abd99) | | 2026-05-13 | [GHSA-6h4j-wcr9-2vg7](https://github.com/n8n-io/n8n/security/advisories/GHSA-6h4j-wcr9-2vg7) | High | Cross-user Authorization Bypass in Dynamic Credential OAuth Endpoints | [`293d5afd`](https://github.com/n8n-io/n8n/commit/293d5afd643f2a6df6195073beed314679399290) | | 2026-06-10 | [GHSA-2j5h-858j-5mpf](https://github.com/n8n-io/n8n/security/advisories/GHSA-2j5h-858j-5mpf) | High | Cross-Tenant Credential Takeover via Dynamic Credentials EE Endpoints | [`71262655`](https://github.com/n8n-io/n8n/commit/71262655e46f2f78a4a15c58661226762f83365c) | | 2026-07-08 | [GHSA-q5xf-xhwf-cwqf](https://github.com/n8n-io/n8n/security/advisories/GHSA-q5xf-xhwf-cwqf) | Medium | Member-Level Users Can Execute Other Users' MCP Server Trigger Workflows via Missing OAuth Authorization Check | [`46c1a0e8`](https://github.com/n8n-io/n8n/commit/46c1a0e8f32db71c79ec4187f75d2184053f1dad) | | 2026-07-08 | [GHSA-x5vx-c2c8-m3w9](https://github.com/n8n-io/n8n/security/advisories/GHSA-x5vx-c2c8-m3w9) | High | AI Agents Project Viewer Privilege Escalation via run_node_tool | [`46c1a0e8`](https://github.com/n8n-io/n8n/commit/46c1a0e8f32db71c79ec4187f75d2184053f1dad) | ### n10. Python Code node isolation is a static AST/attribute denylist that is structurally incomplete *recurring, 6 findings* **Root cause.** User Python is confined by a hand-maintained static AST SecurityValidator plus a BLOCKED_ATTRIBUTES/BLOCKED_NAMES denylist (even after moving to the out-of-process native runner, that runner's gate IS the denylist), so any un-visited AST form (Constant/MatchClass/Global/FunctionDef/format-strings) or un-listed introspection dunder reaches a runtime escape. **Prevent.** Python sandbox safety must not depend on completeness of a syntactic denylist; new language constructs and format/introspection entry points must fail closed (validated at runtime), and the executing process must not hold host capabilities the denylist is trying to seal. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2025-12-08 | [GHSA-62r4-hw23-cc8v](https://github.com/n8n-io/n8n/security/advisories/GHSA-62r4-hw23-cc8v) | Critical | Arbitrary Command Execution in Pyodide based Python Code Node | [`a4757cf0`](https://github.com/n8n-io/n8n/commit/a4757cf009839a951e8cd5295cd9d549a21f5714) | | 2026-01-29 | [GHSA-8398-gmmx-564h](https://github.com/n8n-io/n8n/security/advisories/GHSA-8398-gmmx-564h) | Critical | Python sandbox escape | [`76b4604a`](https://github.com/n8n-io/n8n/commit/76b4604a311885649751c93718d9a7c012e5d5fc) | | 2026-02-25 | [GHSA-mmgg-m5j7-f83h](https://github.com/n8n-io/n8n/security/advisories/GHSA-mmgg-m5j7-f83h) | Critical | Python Code Node Sandbox Escape | [`562d8674`](https://github.com/n8n-io/n8n/commit/562d867483e871b0f1e31776252e23bd721df75b) | | 2026-04-22 | [GHSA-44v6-jhgm-p3m4](https://github.com/n8n-io/n8n/security/advisories/GHSA-44v6-jhgm-p3m4) | High | Python Task Runner Sandbox Escape | [`85b77964`](https://github.com/n8n-io/n8n/commit/85b7796434df7e80c4023666e2c0ede6e526a6ba) | | 2026-05-27 | [GHSA-9pq8-m8gp-4p53](https://github.com/n8n-io/n8n/security/advisories/GHSA-9pq8-m8gp-4p53) | High | Python sandbox escape | [`d4f92238`](https://github.com/n8n-io/n8n/commit/d4f9223842f0584579639647e047a0f4e78a2259) | | 2026-06-10 | [GHSA-jwm3-qcfw-c5pp](https://github.com/n8n-io/n8n/security/advisories/GHSA-jwm3-qcfw-c5pp) | Medium | Python Code Node AST Validator Bypass | [`71262655`](https://github.com/n8n-io/n8n/commit/71262655e46f2f78a4a15c58661226762f83365c) | ### n11. External IdP/directory identity claim trusted for account-linking, provisioning, or scope-granting without verification *recurring, 5 findings* **Root cause.** n8n binds a local account or grants a role/scope based on an external identity provider's claim (OIDC sub, email, IdP-mapped role) without verifying the claim legitimately and uniquely establishes that binding — no (issuer,subject) composite key, no email-verified/uniqueness check, no role ceiling, and scopes hard-coded rather than role-derived. **Prevent.** An external IdP claim (subject, email, role) may bind to or elevate a local account only after issuer-scoping, email verification/uniqueness, and a role ceiling are enforced; treating a validly-signed claim as sufficient proof of account ownership or role fails review. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2025-11-18 | [GHSA-c545-x2rh-82fc](https://github.com/n8n-io/n8n/security/advisories/GHSA-c545-x2rh-82fc) | High | LDAP Email-Based Account Linking Allows Privilege Escalation and Account Takeover | [`b3af602e`](https://github.com/n8n-io/n8n/commit/b3af602ed08e11591e17597183cca9c2ab1ff37c) | | 2026-06-24 | [GHSA-mq3m-f8x3-579w](https://github.com/n8n-io/n8n/security/advisories/GHSA-mq3m-f8x3-579w) | High | Cross-Issuer Token Exchange Account Binding via Subject-Only Identity Resolution | [`a4bc50f9`](https://github.com/n8n-io/n8n/commit/a4bc50f9a0633d0fb63b0ef1e4a4fd8e0fe7f34b) | | 2026-07-08 | [GHSA-35q8-9mj6-wjmf](https://github.com/n8n-io/n8n/security/advisories/GHSA-35q8-9mj6-wjmf) | High | SSO Instance-Role Provisioning Allows Privilege Escalation to Instance Owner | [`46c1a0e8`](https://github.com/n8n-io/n8n/commit/46c1a0e8f32db71c79ec4187f75d2184053f1dad) | | 2026-07-08 | [GHSA-777w-rpr6-c52h](https://github.com/n8n-io/n8n/security/advisories/GHSA-777w-rpr6-c52h) | High | Privilege Escalation and Code Execution via Full Public API Key Scope Assignment to Token Exchange JWTs | [`46c1a0e8`](https://github.com/n8n-io/n8n/commit/46c1a0e8f32db71c79ec4187f75d2184053f1dad) | | 2026-07-22 | [GHSA-8342-988q-86cr](https://github.com/n8n-io/n8n/security/advisories/GHSA-8342-988q-86cr) | High | Account Takeover via Unverified Email Claim in Token Exchange Embed Login | [`2222fe3a`](https://github.com/n8n-io/n8n/commit/2222fe3a6c886a9059f28e1b6d4bdb10ee420624) | ### n12. Git node invokes git without constraining git's dangerous execution features (hooks, protocols, args, env, repo discovery) *recurring, 5 findings* **Root cause.** The Git node constructs the simple-git/child_process invocation and forwards author-controlled parameters and a working tree populated from an untrusted repo, without constraining git's code-executing surfaces: hooks run by default, free-form config keys, no `--` arg terminator, a prototype-inheriting env object, unrestricted transports, and automatic bare-repo discovery. **Prevent.** Every git subprocess spawned by n8n must be constructed by the hardened invocation builder that disables hooks, pins repository discovery, terminates arguments, sanitizes the environment, and restricts transports; direct simpleGit()/spawn of git elsewhere is forbidden. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2025-09-22 | [GHSA-xgp7-7qjq-vg47](https://github.com/n8n-io/n8n/security/advisories/GHSA-xgp7-7qjq-vg47) | High | Remote Code Execution via Git Node Pre-Commit Hook | [`5bf3db5b`](https://github.com/n8n-io/n8n/commit/5bf3db5ba84d3195bbe11bbd3c62f7086e090997) | | 2025-11-14 | [GHSA-wpqc-h9wp-chmq](https://github.com/n8n-io/n8n/security/advisories/GHSA-wpqc-h9wp-chmq) | Critical | Remote Code Execution via Git Node Custom Pre-Commit Hook | [`4dd853b2`](https://github.com/n8n-io/n8n/commit/4dd853b2d5fe5e35940c14813da0fa72b6c87136) | | 2026-01-02 | [GHSA-9g95-qf3f-ggrw](https://github.com/n8n-io/n8n/security/advisories/GHSA-9g95-qf3f-ggrw) | Critical | OS Command Injection in Git Node | [`503f2990`](https://github.com/n8n-io/n8n/commit/503f29901c568d15778e5e853e804b6e5a7a96db) | | 2026-05-13 | [GHSA-57g9-58c2-xjg3](https://github.com/n8n-io/n8n/security/advisories/GHSA-57g9-58c2-xjg3) | Critical | Arbitrary File Read via Git Node | [`293d5afd`](https://github.com/n8n-io/n8n/commit/293d5afd643f2a6df6195073beed314679399290) | | 2026-07-22 | [GHSA-rcv6-pvrj-4xcg](https://github.com/n8n-io/n8n/security/advisories/GHSA-rcv6-pvrj-4xcg) | High | Authenticated code execution in the n8n Git node | [`2222fe3a`](https://github.com/n8n-io/n8n/commit/2222fe3a6c886a9059f28e1b6d4bdb10ee420624) | ### n13. Network entry points registered outside the standard authenticated-controller pipeline enforce no/weak authentication *recurring, 4 findings* **Root cause.** Ad-hoc request handlers — a raw Express route mounted before auth middleware, a bespoke HTTP/WebSocket server, a node webhook context lacking session-validation primitives — each re-implement or skip authentication because there is no rule forcing every ingress through the central authenticated pipeline and no session/capability primitive exposed to those contexts. **Prevent.** Every network entry point must pass through the central authentication gate before doing work; a route hand-registered outside the controller framework, a bespoke server minting sessions without a token, or a node context trusting mere presence of a cookie/id fails review. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2026-02-25 | [GHSA-jh8h-6c9q-7gmw](https://github.com/n8n-io/n8n/security/advisories/GHSA-jh8h-6c9q-7gmw) | Medium | Authentication Bypass in Chat Trigger Node | [`562d8674`](https://github.com/n8n-io/n8n/commit/562d867483e871b0f1e31776252e23bd721df75b) | | 2026-04-22 | [GHSA-f77h-j2v7-g6mw](https://github.com/n8n-io/n8n/security/advisories/GHSA-f77h-j2v7-g6mw) | Medium | Hijacking of Unauthenticated Chat Execution | [`85b77964`](https://github.com/n8n-io/n8n/commit/85b7796434df7e80c4023666e2c0ede6e526a6ba) | | 2026-06-10 | [GHSA-qrx8-25qr-5r7v](https://github.com/n8n-io/n8n/security/advisories/GHSA-qrx8-25qr-5r7v) | High | n8n MCP Browser HTTP Transport Exposes Unauthenticated Browser-Control Sessions | [`71262655`](https://github.com/n8n-io/n8n/commit/71262655e46f2f78a4a15c58661226762f83365c) | | 2026-06-23 | [GHSA-33q9-f52j-gc75](https://github.com/n8n-io/n8n/security/advisories/GHSA-33q9-f52j-gc75) | Medium | Unauthenticated Endpoint Allows Cancellation of Any User's Active Test Webhook | [`1a02b537`](https://github.com/n8n-io/n8n/commit/1a02b53784d556f65cc2ed314f2f0e0a24a87604) | ### n14. JS Task Runner exposes host-realm objects / shared state to untrusted Code-node JS; isolation by incomplete denylist *recurring, 4 findings* **Root cause.** The JavaScript Task Runner executes every user's Code node in one long-lived Node process and injects host-realm objects (full Buffer, a host `module`, the shared CommonJS require cache) into the vm context, hardened only by an incomplete denylist/proxy, so uninitialized memory, constructor-chain traversal to the host realm, and cross-tenant cache mutation are reachable. **Prevent.** No host-realm object or shared mutable state may be reachable from Code-node JS: exposed globals must be sandbox-realm and frozen, dangerous native primitives neutralized on the real constructor, and any object handed out of a shared cache must be write-isolated per task. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2025-10-06 | [GHSA-49mx-fj45-q3p6](https://github.com/n8n-io/n8n/security/advisories/GHSA-49mx-fj45-q3p6) | High | Unsafe Buffer Allocation Allows In-Process Memory Disclosure in Task Runner | [`b0de49cf`](https://github.com/n8n-io/n8n/commit/b0de49cfbfb1542394e8f34497212bd7c72b1ba0) | | 2026-02-25 | [GHSA-jjpj-p2wh-qf23](https://github.com/n8n-io/n8n/security/advisories/GHSA-jjpj-p2wh-qf23) | Critical | Sandbox Escape in JavaScript Task Runner | [`562d8674`](https://github.com/n8n-io/n8n/commit/562d867483e871b0f1e31776252e23bd721df75b) | | 2026-02-25 | [GHSA-xvh5-5qg4-x9qp](https://github.com/n8n-io/n8n/security/advisories/GHSA-xvh5-5qg4-x9qp) | High | In-Process Memory Disclosure in Task Runner | [`562d8674`](https://github.com/n8n-io/n8n/commit/562d867483e871b0f1e31776252e23bd721df75b) | | 2026-07-22 | [GHSA-9cmh-xcqm-5hqr](https://github.com/n8n-io/n8n/security/advisories/GHSA-9cmh-xcqm-5hqr) | Medium | Cross-Tenant Module-Cache Poisoning in the JS Task Runner | [`2222fe3a`](https://github.com/n8n-io/n8n/commit/2222fe3a6c886a9059f28e1b6d4bdb10ee420624) | ### n15. Merge node runs untrusted SQL through alasql, an engine that compiles SQL to JS and exposes host I/O *recurring, 4 findings* **Root cause.** Merge 'Combine by SQL' hands workflow-authored SQL to alasql, which exposes file/network data sources, a REQUIRE/inline-JavaScript()/CREATE FUNCTION code-execution grammar, and (via a cached shared VM context) cross-tenant state, defended only by hand-maintained denylists and a reused isolate context. **Prevent.** Untrusted SQL passed to an in-process SQL engine must run with every file/network/code-execution capability of that engine disabled and in a per-execution isolated context; relying on a denylist of engine features or a shared cached context fails review. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2025-10-27 | [GHSA-hv53-3329-vmrm](https://github.com/n8n-io/n8n/security/advisories/GHSA-hv53-3329-vmrm) | Critical | Arbitrary File Write leading to RCE in n8n Merge Node | [`9ce3ac09`](https://github.com/n8n-io/n8n/commit/9ce3ac092cf7339f3c4a416cdea6e5fa2d5b22b9) | | 2026-02-25 | [GHSA-wxx7-mcgf-j869](https://github.com/n8n-io/n8n/security/advisories/GHSA-wxx7-mcgf-j869) | Critical | Remote Code Execution via Merge Node | [`562d8674`](https://github.com/n8n-io/n8n/commit/562d867483e871b0f1e31776252e23bd721df75b) | | 2026-03-25 | [GHSA-58qr-rcgv-642v](https://github.com/n8n-io/n8n/security/advisories/GHSA-58qr-rcgv-642v) | Critical | RCE via SQL Mode of Merge Node | [`2d9a2ec7`](https://github.com/n8n-io/n8n/commit/2d9a2ec76e180b54e8091e31b1e0638c909abd99) | | 2026-06-10 | [GHSA-9c38-2mcm-q7f7](https://github.com/n8n-io/n8n/security/advisories/GHSA-9c38-2mcm-q7f7) | Medium | Merge Node SQL Mode Prototype Pollution | [`71262655`](https://github.com/n8n-io/n8n/commit/71262655e46f2f78a4a15c58661226762f83365c) | ### n16. State-changing / execution endpoints authorized with a read-level or coarse scope instead of the action-appropriate write scope *recurring, 4 findings* **Root cause.** Execution- and state-mutating REST/public-API handlers were copied from read-endpoint patterns and inherited the shared authz helper's permissive default ['workflow:read'] (or a coarse 'user has >=1 workflow' presence check), so the authorization layer never required workflow:execute for actions that run or mutate workflows. **Prevent.** A handler that triggers, retries, stops, or mutates a workflow/run must pass an explicit action-matching scope (workflow:execute or higher) to the authz helper; relying on the helper's default scope for a non-GET action fails review. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2025-06-19 | [GHSA-gq57-v332-7666](https://github.com/n8n-io/n8n/security/advisories/GHSA-gq57-v332-7666) | Medium | Improper Authorization in Workflow Execution Stop Endpoint Allows Terminating Other Users' Workflows | [`29752ead`](https://github.com/n8n-io/n8n/commit/29752ead000ac002ba3606ddda15b552ad2d3048) | | 2026-06-10 | [GHSA-664h-gpgq-h6xx](https://github.com/n8n-io/n8n/security/advisories/GHSA-664h-gpgq-h6xx) | Medium | Wrong OAuth Scope on Evaluation Test Runs Endpoints | [`71262655`](https://github.com/n8n-io/n8n/commit/71262655e46f2f78a4a15c58661226762f83365c) | | 2026-06-10 | [GHSA-h3jj-5f3v-3685](https://github.com/n8n-io/n8n/security/advisories/GHSA-h3jj-5f3v-3685) | Medium | Public API Execution Retry Authorization Bypass | [`71262655`](https://github.com/n8n-io/n8n/commit/71262655e46f2f78a4a15c58661226762f83365c) | | 2026-06-10 | [GHSA-hv7x-3x78-gx53](https://github.com/n8n-io/n8n/security/advisories/GHSA-hv7x-3x78-gx53) | Medium | Wrong OAuth Scope On Evaluations Test Run Creation Endpoint | [`71262655`](https://github.com/n8n-io/n8n/commit/71262655e46f2f78a4a15c58661226762f83365c) | ### n17. Trigger nodes accept forged inbound webhooks without verifying provider signature/token *recurring, 4 findings* **Root cause.** Third-party trigger nodes treat any POST to their public webhook URL as authentic, injecting the body straight into execution, because there is no shared 'verify inbound webhook authenticity' primitive — each node would have to fetch/store the provider secret and verify the HMAC/JWT itself, and several simply didn't. **Prevent.** A trigger node that ingests third-party webhook deliveries must verify the provider's signature/token before the body reaches workflow execution; a webhook handler that runs on mere URL possession fails review. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2026-01-02 | [GHSA-jf52-3f2h-h9j5](https://github.com/n8n-io/n8n/security/advisories/GHSA-jf52-3f2h-h9j5) | Medium | Missing Stripe-Signature Verification Allows Unauthenticated Forged Webhooks | [`f816b390`](https://github.com/n8n-io/n8n/commit/f816b39070d9010c8eaaa152482b29bf85fc01dc) | | 2026-01-15 | [GHSA-mqpr-49jj-32rc](https://github.com/n8n-io/n8n/security/advisories/GHSA-mqpr-49jj-32rc) | Medium | Webhook Forgery on Github Webhook Trigger | [`64c9148e`](https://github.com/n8n-io/n8n/commit/64c9148e1d65ad9e666bf37cf71720b876b58926) | | 2026-01-28 | [GHSA-38c7-23hj-2wgq](https://github.com/n8n-io/n8n/security/advisories/GHSA-38c7-23hj-2wgq) | Medium | Webhook Forgery on Zendesk Trigger | [`4622acac`](https://github.com/n8n-io/n8n/commit/4622acaccc69afb9720390e8e0011f490208fd1a) | | 2026-06-10 | [GHSA-jvc7-762p-3743](https://github.com/n8n-io/n8n/security/advisories/GHSA-jvc7-762p-3743) | Medium | Missing Token Validation on Microsoft Agent 365 Trigger and Stripe Nodes | [`71262655`](https://github.com/n8n-io/n8n/commit/71262655e46f2f78a4a15c58661226762f83365c) | ### n18. Node property's declared type/contract (string, enum, noDataExpression) not enforced at runtime parameter resolution *recurring, 3 findings* **Root cause.** A node property's declared type or flag (type:string, an options/enum dropdown, noDataExpression:true) is treated as UI/compile-time advisory only; the expression engine yields arbitrary strings/objects at runtime and getNodeParameters does not coerce or enforce the declaration, so a value that 'looks' constrained reaches a dangerous sink as an arbitrary type. **Prevent.** A parameter declared with a constrained type/enum or noDataExpression must be runtime-guaranteed to satisfy that declaration before a node reads it; a node relying on an `as string` cast or a trusted-enum assumption for a security-relevant value fails review. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2026-02-25 | [GHSA-75g8-rv7v-32f7](https://github.com/n8n-io/n8n/security/advisories/GHSA-75g8-rv7v-32f7) | High | Unauthenticated Expression Evaluation via Form Node | [`562d8674`](https://github.com/n8n-io/n8n/commit/562d867483e871b0f1e31776252e23bd721df75b) | | 2026-07-22 | [GHSA-2x35-3fw4-9jr4](https://github.com/n8n-io/n8n/security/advisories/GHSA-2x35-3fw4-9jr4) | High | Send Email Node Arbitrary File Read and SSRF via Nodemailer Content-Object Type Confusion | [`2222fe3a`](https://github.com/n8n-io/n8n/commit/2222fe3a6c886a9059f28e1b6d4bdb10ee420624) | | 2026-07-22 | [GHSA-xmc9-4f2h-jf9c](https://github.com/n8n-io/n8n/security/advisories/GHSA-xmc9-4f2h-jf9c) | High | Edit Image Node Format Injection Allows Arbitrary File Write | [`2222fe3a`](https://github.com/n8n-io/n8n/commit/2222fe3a6c886a9059f28e1b6d4bdb10ee420624) | ### n19. Credential/secret material serialized into a user-reachable or logged structure without redaction *recurring, 3 findings* **Root cause.** Secret material that lives inside request headers, model options, or key fields is serialized into a context that is exposed to workflow expressions, recorded as execution/observability data, or emitted in a token header, because redaction was applied only to a narrow UI preview (or not at all) rather than at the serialization boundary. **Prevent.** Any structure exposed to workflow expressions, persisted as execution/observability data, or emitted in a token must have credential/secret fields redacted at the serialization boundary; reusing a live secret-bearing request/model object as user-visible data fails review. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2026-06-24 | [GHSA-q3j5-8vrg-4p9q](https://github.com/n8n-io/n8n/security/advisories/GHSA-q3j5-8vrg-4p9q) | High | Shared Credential Header Leak via HTTP Request Pagination Expression | [`a4bc50f9`](https://github.com/n8n-io/n8n/commit/a4bc50f9a0633d0fb63b0ef1e4a4fd8e0fe7f34b) | | 2026-07-08 | [GHSA-89gh-3pgc-v5h2](https://github.com/n8n-io/n8n/security/advisories/GHSA-89gh-3pgc-v5h2) | Medium | Custom Header Credential Values Leaked in Plaintext into LLM Node Execution Data | [`46c1a0e8`](https://github.com/n8n-io/n8n/commit/46c1a0e8f32db71c79ec4187f75d2184053f1dad) | | 2026-07-08 | [GHSA-9r8p-h6cc-6qhm](https://github.com/n8n-io/n8n/security/advisories/GHSA-9r8p-h6cc-6qhm) | Medium | Google Service Account Private Key Exposed in JWT Header | [`46c1a0e8`](https://github.com/n8n-io/n8n/commit/46c1a0e8f32db71c79ec4187f75d2184053f1dad) | ### n20. Untrusted-input-driven operations run with no resource budget / quota (DoS) *recurring, 3 findings* **Root cause.** Amplifying operations reachable from untrusted input — unauthenticated OAuth client registration, archive decompression, temp-dir file uploads — execute with no upper bound (unconditional insert, whole-buffer decode, cache-based size estimate), so an attacker exhausts DB rows, memory, or disk. **Prevent.** An operation whose cost is driven by untrusted input (registration count, decompressed size, uploaded bytes) must run under an enforced, measured resource budget that fails closed; unbounded insert/decode/write against attacker-controlled volume fails review. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2026-04-22 | [GHSA-49m9-pgww-9vq6](https://github.com/n8n-io/n8n/security/advisories/GHSA-49m9-pgww-9vq6) | High | Unauthenticated Denial of Service via MCP Client Registration | [`2d9a2ec7`](https://github.com/n8n-io/n8n/commit/2d9a2ec76e180b54e8091e31b1e0638c909abd99) | | 2026-06-02 | [GHSA-jqpw-qww5-cj4c](https://github.com/n8n-io/n8n/security/advisories/GHSA-jqpw-qww5-cj4c) | Medium | Denial of Service via ZIP decompression in webhook workflow | [`90dd93c7`](https://github.com/n8n-io/n8n/commit/90dd93c7723f33f71ea1382cad3f921715ae8409) | | 2026-06-18 | [GHSA-w867-jm58-p9pv](https://github.com/n8n-io/n8n/security/advisories/GHSA-w867-jm58-p9pv) | Medium | Authenticated Users Can Exhaust Temporary Disk Storage via Data-Table File Uploads | [`e4757d25`](https://github.com/n8n-io/n8n/commit/e4757d25843e4d27727e7c19576605100315abf0) | ### n21. computer-use exposes host-capable tools to the agent with confinement enforced at the wrong altitude / not fail-closed *recurring, 2 findings* **Root cause.** The computer-use module exposes host-capable tools (shell, filesystem search) to the agent, but confinement was opportunistic and syntactic — an OS-specific if(isMac) sandbox with isSupported() always true, and a syntactic glob-pattern check instead of validating expanded paths — so tools ran unsandboxed or escaped their base directory. **Prevent.** Every computer-use host tool must enforce confinement fail-closed on the concrete resource it will act on (a working process sandbox, or the realpath of each expanded match); an opportunistic per-OS sandbox or a syntactic pre-expansion check fails review. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2026-07-08 | [GHSA-fpg6-x68q-5793](https://github.com/n8n-io/n8n/security/advisories/GHSA-fpg6-x68q-5793) | Medium | computer-use Shell Sandbox Not Enforced on Linux and Windows | [`46c1a0e8`](https://github.com/n8n-io/n8n/commit/46c1a0e8f32db71c79ec4187f75d2184053f1dad) | | 2026-07-22 | [GHSA-pf2q-pxhf-hgmw](https://github.com/n8n-io/n8n/security/advisories/GHSA-pf2q-pxhf-hgmw) | Medium | Path-Confinement Bypass in computer-use search_files Allows Reading Files Outside the Base Directory | [`2222fe3a`](https://github.com/n8n-io/n8n/commit/2222fe3a6c886a9059f28e1b6d4bdb10ee420624) | ### n22. Host-privileged execution enabled by default under a flat trust model (no default isolation/opt-in) *recurring, 2 findings* **Root cause.** Capabilities that grant host-level execution — the Execute Command node and the legacy in-process Code node (vm2 seeded with privileged FileSystem helpers, task-runner isolation off by default) — were loaded/enabled out of the box for every authenticated user, with no default-deny/opt-in gate and no per-node capability boundary separating host-privileged nodes from ordinary integrations. **Prevent.** A built-in capability that yields host command execution or in-process filesystem access must be default-off or default-isolated and require explicit operator opt-in; shipping such a capability enabled under the flat authenticated-user trust model fails review. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2025-10-08 | [GHSA-365g-vjw2-grx8](https://github.com/n8n-io/n8n/security/advisories/GHSA-365g-vjw2-grx8) | High | Execute Command Node in n8n Allows Authenticated Users to Run Arbitrary Commands on Host | [`a4757cf0`](https://github.com/n8n-io/n8n/commit/a4757cf009839a951e8cd5295cd9d549a21f5714) | | 2025-12-08 | [GHSA-j4p8-h8mh-rh8q](https://github.com/n8n-io/n8n/security/advisories/GHSA-j4p8-h8mh-rh8q) | High | Legacy Code node enables file read/write in self-hosted n8n | [`84247555`](https://github.com/n8n-io/n8n/commit/8424755513c56d0e82625be554f526752c2c0ff7) | ### n23. Client payload writes server-controlled / privileged fields (mass-assignment) at a self-service boundary *recurring, 2 findings* **Root cause.** Create/update/self-service handlers build the entity via Object.assign(new Entity(), body) trusting a broad DTO that whitelisted server-controlled relations or admin-only fields, so a client can set fields (parentFolder relation, allowSSOManualLogin) it has no authority over. **Prevent.** A write endpoint must bind to a field-allowlist DTO scoped to what the caller may set; reusing a broad/admin DTO or Object.assign-ing a raw payload onto an entity at a self-service boundary fails review. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2026-02-10 | [GHSA-vjf3-2gpj-233v](https://github.com/n8n-io/n8n/security/advisories/GHSA-vjf3-2gpj-233v) | Medium | SSO Enforcement Bypass | [`a70b2ea3`](https://github.com/n8n-io/n8n/commit/a70b2ea379086da3de103bb84811e88cadf29976) | | 2026-06-23 | [GHSA-2xgm-wc4g-5jvg](https://github.com/n8n-io/n8n/security/advisories/GHSA-2xgm-wc4g-5jvg) | Medium | Improper Authorization Allows Authenticated Users to Assign Workflows to Folders in Other Projects | [`0f1c1a82`](https://github.com/n8n-io/n8n/commit/0f1c1a82a431d6e4e460018370fa5ebcc9935660) | ### n24. Binary-data ID accepted without well-formedness validation of the fileId, resolving to the storage root *singleton* **Root cause.** The binary-data controller/DTO validated only the mode prefix of a mode:fileId id; an empty or slash-only fileId passed and the filesystem manager resolved it to the storage root directory. **Prevent.** An id whose components address the filesystem must be validated well-formed (non-empty, no root-resolving segments) before a path is derived from it. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2025-06-16 | [GHSA-pr9r-gxgp-9rm8](https://github.com/n8n-io/n8n/security/advisories/GHSA-pr9r-gxgp-9rm8) | Medium | Denial of Service via Malformed Binary Data Requests | [`43c52a8b`](https://github.com/n8n-io/n8n/commit/43c52a8b4f844e91b02e3cc9df92826a2d7b6052) | ### n25. Attacker-controlled filename used as a filesystem path component without reduction to a bare basename *singleton* **Root cause.** The SSH upload (and binary copy helper) concatenate an uploaded binary's filename metadata directly into a remote destination path with no basename reduction or rejection of ../, absolute paths, backslashes, or null bytes. **Prevent.** A filename from binary metadata or user input used as a path component must be reduced to a validated basename before touching any (local or remote) filesystem. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2026-01-12 | [GHSA-m82q-59gv-mcr9](https://github.com/n8n-io/n8n/security/advisories/GHSA-m82q-59gv-mcr9) | High | Arbitrary File Write on Remote Systems via SSH Node | [`e0baf48c`](https://github.com/n8n-io/n8n/commit/e0baf48c6a54808f6dbca8cb352bfa306092c223) | ### n26. Inbound IP allowlist compared as opaque strings (substring match) instead of structured address matching *singleton* **Root cause.** The Webhook node's isIpWhitelisted used String.includes on IP strings, so any address containing a whitelist entry as a substring matched. **Prevent.** An IP/subnet allowlist decision must use structured address matching, never substring/string comparison. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2025-12-22 | [GHSA-w96v-gf22-crwp](https://github.com/n8n-io/n8n/security/advisories/GHSA-w96v-gf22-crwp) | Medium | IP Whitelist Bypass via Partial String Matching | [`11f8597d`](https://github.com/n8n-io/n8n/commit/11f8597d4ad69ea3b58941573997fdbc4de1fec5) | ### n27. LDAP search filter built by concatenating user data without RFC 4515 escaping *singleton* **Root cause.** The LDAP node concatenates filter structure and user data into one string, then applies inverted replace() rules, so raw \ * ( ) NUL in user data alter the filter. **Prevent.** User-controlled values entering an LDAP filter must be RFC 4515-escaped per value before assembly; post-hoc replace() over an assembled filter fails review. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2026-03-25 | [GHSA-w83q-mcmx-mh42](https://github.com/n8n-io/n8n/security/advisories/GHSA-w83q-mcmx-mh42) | Medium | LDAP Filter Injection in LDAP Node | [`2d9a2ec7`](https://github.com/n8n-io/n8n/commit/2d9a2ec76e180b54e8091e31b1e0638c909abd99) | ### n28. Guardrail node trusts the model's free-form structured output and a soft in-prompt delimiter as a trust boundary *singleton* **Root cause.** The Guardrails checks used a non-strict zod schema (extra/renamed fields tolerated), no post-parse type check, and a bypassable '########' in-prompt delimiter to separate rules from screened user input. **Prevent.** A safety check driven by an LLM must strictly validate the model's structured output and must not treat an in-prompt text delimiter as a trust boundary between instructions and untrusted input. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2026-02-23 | [GHSA-fvfv-ppw4-7h2w](https://github.com/n8n-io/n8n/security/advisories/GHSA-fvfv-ppw4-7h2w) | Medium | n8n Guardrail Node Bypass | [`8d0251d1`](https://github.com/n8n-io/n8n/commit/8d0251d1deef256fd3d9176f05dedab62afde918) | ### n29. NoSQL query filter built from a raw value, letting operator-shaped objects be interpreted as query operators *singleton* **Root cause.** The MongoDB node substitutes a raw JSON item value directly into an equality filter with no scalar-type validation, so an object value carrying $ne/$regex/$gt is interpreted as query operators. **Prevent.** A value interpolated into a NoSQL query filter must be type-validated as a scalar unless the query structure is explicitly author-intended. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2026-06-02 | [GHSA-jpq7-226w-6cxx](https://github.com/n8n-io/n8n/security/advisories/GHSA-jpq7-226w-6cxx) | Medium | NoSQL Injection in MongoDB Node Find And Replace Operation | [`439d2601`](https://github.com/n8n-io/n8n/commit/439d2601815a72bf93ca185af1e5b49c520fa9af) | ### n30. Shell command built by unescaped string interpolation of user input *singleton* **Root cause.** The community-package install builds an `npm pack ...@${version}` command by unescaped interpolation run through a real shell, with no validation that the user-supplied version is a well-formed semver. **Prevent.** No user-supplied value may be concatenated into a shell command string without a strict format allowlist and/or argv-array execution. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2025-11-14 | [GHSA-7c4h-vh2m-743m](https://github.com/n8n-io/n8n/security/advisories/GHSA-7c4h-vh2m-743m) | Low | Command Injection in Community Package Installation | [`6eeb739c`](https://github.com/n8n-io/n8n/commit/6eeb739c9283e4691f5754494dcd223319a74f2c) | ### n31. SSH host-key verification disabled (StrictHostKeyChecking=no), enabling MITM *singleton* **Root cause.** Source Control's git SSH command hardcoded StrictHostKeyChecking=no to avoid first-connection prompts, disabling host-key verification entirely and rendering the known_hosts file inert. **Prevent.** An outbound SSH transport must verify host keys (accept-new/strict); hardcoding StrictHostKeyChecking=no fails review. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2026-01-20 | [GHSA-43v7-fp2v-68f6](https://github.com/n8n-io/n8n/security/advisories/GHSA-43v7-fp2v-68f6) | Medium | MITM Vulnerability for Source Control with SSH | [`6a1bdd29`](https://github.com/n8n-io/n8n/commit/6a1bdd2950b67fdfa7618a59bbdde36e762c7d6d) | ### n32. Handlers treat request-body file descriptors as parser-produced without verifying multipart provenance *singleton* **Root cause.** Webhook/form/chat handlers read getBodyData().files for any content type, so an attacker-supplied JSON/XML/urlencoded body can inject arbitrary filepaths that only formidable's multipart parser was trusted to produce. **Prevent.** Any handler that reads request-body file descriptors must first assert the body was multipart/form-data; consuming body.files for arbitrary content types fails review. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2025-11-18 | [GHSA-v4pr-fm98-w9pg](https://github.com/n8n-io/n8n/security/advisories/GHSA-v4pr-fm98-w9pg) | Critical | Unauthenticated File Access via Improper Webhook Request Handling | [`c8d604d2`](https://github.com/n8n-io/n8n/commit/c8d604d2c466dd84ec24f4f092183d86e43f2518) | --- ## GitLab 434 disclosed vulnerabilities, grouped into 73 root cause classes (65 recurring, 8 singletons). Recurrence rate 58% (251 of 434). Classes are ordered largest first. ### G1. Coarse list/serialization authz treated as per-object read authorization *recurring, 22 findings* **Root cause.** List, serializer, dashboard, and cross-object exposure paths trust a single coarse check (finder SQL visibility, group/project read, list permission) and never re-verify per-object/per-field read authorization, so confidential issues, other users exports, branch names, emails, environments, packages, sibling MRs, and sensitive values leak. **Prevent.** Every collection/serializer runs each returned object/field through a per-object read policy before exposure; enforced by a shared authorized-serialization helper + tests. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2024-06-25 | [CVE-2024-2191](https://nvd.nist.gov/vuln/detail/CVE-2024-2191) | Medium | Source code management - project branches listing view (Projects::BranchesController#index / _branch.html.haml) | [`c376da89`](https://gitlab.com/gitlab-org/gitlab/-/commit/c376da899140) | | 2024-07-24 | [CVE-2024-7060](https://nvd.nist.gov/vuln/detail/CVE-2024-7060) | Low | Project/Group Import-Export (import_export_upload) download endpoints | [`762b76f8`](https://gitlab.com/gitlab-org/gitlab/-/commit/762b76f8c82061702e4854b978462f8f5f915a4d) | | 2024-07-24 | [CVE-2024-7091](https://nvd.nist.gov/vuln/detail/CVE-2024-7091) | Medium | Direct Transfer / bulk-imports relations export API (lib/api/project_export.rb, lib/api/group_export.rb) backed by the BulkImports::Export model and RelationExportService/BatchedRelationExportService | [`ab8e4a0d`](https://gitlab.com/gitlab-org/gitlab/-/commit/ab8e4a0d4c413daa52d65810d4fb849e03617c91) | | 2024-09-11 | [CVE-2024-4660](https://nvd.nist.gov/vuln/detail/CVE-2024-4660) | Medium | Projects :: Create-from-template (EE custom/group project templates) | [`d0c8dcec`](https://gitlab.com/gitlab-org/gitlab/-/commit/d0c8dcecec6c0b1fad95755c2ea5b781680ceb66) | | 2024-09-11 | [CVE-2024-6389](https://nvd.nist.gov/vuln/detail/CVE-2024-6389) | Medium | Projects::ReleasesController - releases Atom (RSS) feed view | [`39dc0863`](https://gitlab.com/gitlab-org/gitlab/-/commit/39dc0863d8fe989069ecc94e538352c5bc57a41b) | | 2024-10-09 | [CVE-2024-5005](https://nvd.nist.gov/vuln/detail/CVE-2024-5005) | Medium | REST API - project templates (lib/api/project_templates.rb) | [`30cdc6ad`](https://gitlab.com/gitlab-org/gitlab/-/commit/30cdc6ad27b6fabcedcd381eedddc306db911546) | | 2024-10-09 | [CVE-2024-9596](https://nvd.nist.gov/vuln/detail/CVE-2024-9596) | Low | super-sidebar / navigation context helpers (app/helpers/sidebars_helper.rb, app/assets/javascripts/super_sidebar) | [`7cc59acb`](https://gitlab.com/gitlab-org/gitlab/-/commit/7cc59acbd64189bc4cd6f6a3a3c829a51ac855ed) | | 2025-05-21 | [CVE-2025-4979](https://nvd.nist.gov/vuln/detail/CVE-2025-4979) | Medium | CI/CD variables (WebUI JSON serializer for project/group/instance CI variables) | [`6e71c801`](https://gitlab.com/gitlab-org/gitlab/-/commit/6e71c801f9fea1afe19de9911813d4921c98bbd4) | | 2025-07-22 | [CVE-2025-0765](https://nvd.nist.gov/vuln/detail/CVE-2025-0765) | Medium | Service Desk / Issues (projects/issues#service_desk view) | [`3f9d9500`](https://gitlab.com/gitlab-org/gitlab/-/commit/3f9d9500a7e39dafc4ef05529f5eaacd08aece0e) | | 2025-08-12 | [CVE-2025-2498](https://nvd.nist.gov/vuln/detail/CVE-2025-2498) | Low | Issues REST API (API::Issues, GET /api/v4/issues) vs. EE group IP allowlist enforcement | [`6a0b4ba0`](https://gitlab.com/gitlab-org/gitlab/-/commit/6a0b4ba092be75ad3752d183e242f2245a7b9b7b) | | 2025-11-11 | [CVE-2025-7000](https://nvd.nist.gov/vuln/detail/CVE-2025-7000) | Medium | Issues / Work Items - related branches (RelatedBranchesService) | [`922a6e08`](https://gitlab.com/gitlab-org/gitlab/-/commit/922a6e081456b26052b9d7330fb1f758356ff454) | | 2025-12-10 | [CVE-2025-13978](https://nvd.nist.gov/vuln/detail/CVE-2025-13978) | Medium | REST API project lookup / CI-CD job-token authorization (Grape API helpers + Git access checks) | [`2aa66477`](https://gitlab.com/gitlab-org/gitlab/-/commit/2aa664777ba214e0f4f0129c98929e08f047feea) | | 2026-02-09 | [CVE-2025-14594](https://nvd.nist.gov/vuln/detail/CVE-2025-14594) | Low | CI pipeline schedules — REST API entity (lib/api/entities/ci/pipeline_schedule.rb) and GraphQL type (app/graphql/types/ci/pipeline_schedule_type.rb) exposing the schedule `inputs` field | [`16512f6c`](https://gitlab.com/gitlab-org/gitlab/-/commit/16512f6cf15fe5dd0f92a0e03ece43703618bc6e) | | 2026-02-09 | [CVE-2026-1080](https://nvd.nist.gov/vuln/detail/CVE-2026-1080) | Medium | Team planning / Iterations (EE) - IterationsFinder feeding the groups/projects iterations REST API | [`19ab1d76`](https://gitlab.com/gitlab-org/gitlab/-/commit/19ab1d761584c8c55acb8df886d1a7966f2397bb) | | 2026-04-07 | [CVE-2025-9484](https://nvd.nist.gov/vuln/detail/CVE-2025-9484) | Medium | GraphQL API - group pending members (EE membership management) | [`57ba23f9`](https://gitlab.com/gitlab-org/gitlab/-/commit/57ba23f9d8cff1cbcf2962cd6d76997c4451dd7e) | | 2026-05-13 | [CVE-2025-13874](https://nvd.nist.gov/vuln/detail/CVE-2025-13874) | Medium | REST API - Issue Links (team_planning / issue tracking) | [`81382857`](https://gitlab.com/gitlab-org/gitlab/-/commit/81382857dd7c) | | 2026-05-13 | [CVE-2026-3074](https://nvd.nist.gov/vuln/detail/CVE-2026-3074) | Medium | Package Registry - NuGet symbol server (debug symbol download) API | [`4f411f5c`](https://gitlab.com/gitlab-org/gitlab/-/commit/4f411f5c36907bed2579626bc645abc5de9e401b) | | 2026-05-13 | [CVE-2026-3160](https://nvd.nist.gov/vuln/detail/CVE-2026-3160) | Medium | Jira integration (EE) - external issue tracker / Jira issues list & detail views | [`3aad273b`](https://gitlab.com/gitlab-org/gitlab/-/commit/3aad273b338714478c76737529735815a3d1bbdf) | | 2026-05-13 | [CVE-2026-4524](https://nvd.nist.gov/vuln/detail/CVE-2026-4524) | Medium | REST API - Issues (move/clone endpoints) + WorkItems::DataSync move service | [`895bac35`](https://gitlab.com/gitlab-org/gitlab/-/commit/895bac350a9f1da03e47c97ab62b4499fcd3218e) | | 2026-05-13 | [CVE-2026-8144](https://nvd.nist.gov/vuln/detail/CVE-2026-8144) | Medium | global_search / group user search | [`7bd0ef71`](https://gitlab.com/gitlab-org/gitlab/-/commit/7bd0ef71173d6bcf48c366626f48579b272ed13d) | | 2026-05-26 | [CVE-2026-2601](https://nvd.nist.gov/vuln/detail/CVE-2026-2601) | Medium | EE Operations Dashboard & Environments Dashboard (ee/app/controllers/operations_controller.rb, ee/app/services/dashboard/*, ee/app/serializers/dashboard_environments_*) | [`489b1738`](https://gitlab.com/gitlab-org/gitlab/-/commit/489b1738433532c01468873b223d9d9268a2e9bd) | | 2026-06-23 | [CVE-2026-3176](https://nvd.nist.gov/vuln/detail/CVE-2026-3176) | Low | EE Security Dashboard / vulnerability risk score GraphQL (Query.group.securityMetrics.riskScore.byProject) | [`b779024c`](https://gitlab.com/gitlab-org/gitlab/-/commit/b779024c552e09a244155b52efa3d8c53dbccdd9) | ### G2. No text-first output-encoding boundary in the Vue frontend *recurring, 16 findings* **Root cause.** The frontend has no shared primitive for rendering untrusted text; components hand-build HTML strings (highlight wrappers, titles, labels, branch names) and render them through the shared v-safe-html/v-html directive whose default DOMPurify allowlist is permissive (permits style/class/id/data-*/js-*//unknown protocols), or the sanitizer is silently bypassed. **Prevent.** A commit-time lint (no-unsanitized / no raw interpolation into v-html or v-safe-html string args) plus a strict default sanitizer config that must be explicitly widened per call-site with review. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2024-04-09 | [CVE-2024-2279](https://nvd.nist.gov/vuln/detail/CVE-2024-2279) | High | content_editor / rich-text-editor autocomplete suggestions dropdown (frontend Vue) | [`dc132c61`](https://gitlab.com/gitlab-org/gitlab/-/commit/dc132c61a896afc1b63ce9cf31b69797eecf95ce) | | 2024-04-09 | [CVE-2024-3092](https://nvd.nist.gov/vuln/detail/CVE-2024-3092) | High | Frontend content_editor (rich text editor) autocomplete / suggestions dropdown, rendered in the merge request diff viewer comment editor (app/assets/javascripts/content_editor) | [`d3ca8e6c`](https://gitlab.com/gitlab-org/gitlab/-/commit/d3ca8e6cc9cc98a48d53d7f968cd922ded0d74f8) | | 2024-10-22 | [CVE-2024-8312](https://nvd.nist.gov/vuln/detail/CVE-2024-8312) | High | Frontend – Super Sidebar Global Search / command palette (shared highlight() text-matching utility) | [`96159ab6`](https://gitlab.com/gitlab-org/gitlab/-/commit/96159ab6cd9af8fc0ceadaf7568c8aaf079a8542) | | 2025-01-22 | [CVE-2025-0314](https://nvd.nist.gov/vuln/detail/CVE-2025-0314) | High | Frontend blob/snippet rich (markup) viewer — client-side HTML sanitization (app/assets/javascripts/vue_shared/components/blob_viewers/rich_viewer.vue) | [`fca347db`](https://gitlab.com/gitlab-org/gitlab/-/commit/fca347dbd3660d89b1a58d39e1cf4ce680363988) | | 2025-02-11 | [CVE-2025-0376](https://nvd.nist.gov/vuln/detail/CVE-2025-0376) | High | merge request widget (vue_merge_request_widget) — pipeline/post-merge pipeline component | [`1cc0ad7a`](https://gitlab.com/gitlab-org/gitlab/-/commit/1cc0ad7a4f3f0ab44dd959a58b3ed63786037a06) | | 2025-02-26 | [CVE-2024-8186](https://nvd.nist.gov/vuln/detail/CVE-2024-8186) | Medium | work-items (child/linked item search token input, Vue frontend) | [`c8b9fff5`](https://gitlab.com/gitlab-org/gitlab/-/commit/c8b9fff5b661fc66476d45a96372e7fd5477a000) | | 2025-03-26 | [CVE-2025-2255](https://nvd.nist.gov/vuln/detail/CVE-2025-2255) | High | Merge request widget (frontend) / merge error rendering | [`5e1e1aff`](https://gitlab.com/gitlab-org/gitlab/-/commit/5e1e1affa536552d9d7f1d50a081a6e98682d8be) | | 2025-06-11 | [CVE-2025-2254](https://nvd.nist.gov/vuln/detail/CVE-2025-2254) | High | GitLab Flavored Markdown JSON-table client renderer (behaviors/markdown) as reached through the snippet viewer | [`cdcf7050`](https://gitlab.com/gitlab-org/gitlab/-/commit/cdcf70509ca177faab705c81fc1ad4c8bc5d8846) | | 2025-06-11 | [CVE-2025-4278](https://nvd.nist.gov/vuln/detail/CVE-2025-4278) | High | Global Search / Zoekt exact-code-search results frontend (Vue) — app/assets/javascripts/search/results | [`80d0d595`](https://gitlab.com/gitlab-org/gitlab/-/commit/80d0d595a34410f1784e2d7905a6d55073305f3e) | | 2025-08-12 | [CVE-2025-6186](https://nvd.nist.gov/vuln/detail/CVE-2025-6186) | High | Work items (issues/tasks/epics) frontend — WorkItemTitle Vue component title rendering | [`3ca4a937`](https://gitlab.com/gitlab-org/gitlab/-/commit/3ca4a93746a14dbb6e3d5a1bb7c0726fdddb83e0) | | 2025-09-25 | [CVE-2025-9642](https://nvd.nist.gov/vuln/detail/CVE-2025-9642) | High | Code navigation (LSIF) source-viewer DOM utilities (frontend, app/assets/javascripts/code_navigation) | [`bcb8c0a7`](https://gitlab.com/gitlab-org/gitlab/-/commit/bcb8c0a7f46ae4f982a978e40ed147bfd35ad4c3) | | 2026-02-09 | [CVE-2026-0595](https://nvd.nist.gov/vuln/detail/CVE-2026-0595) | High | Quality Management / Test Cases (EE) — shared issuable title Vue component | [`ec34719b`](https://gitlab.com/gitlab-org/gitlab/-/commit/ec34719b82a683ff64d47c9f871cc417dee734ac) | | 2026-05-13 | [CVE-2026-6073](https://nvd.nist.gov/vuln/detail/CVE-2026-6073) | High | GitLab Duo Chat (AI assistant) frontend — vendored @gitlab/duo-ui chat markdown renderer (markdown_renderer.js / renderDuoChatMarkdownPreview) | [`d5448f70`](https://gitlab.com/gitlab-org/gitlab/-/commit/d5448f705897be16536efae471938ac0baa2f58f) | | 2026-05-13 | [CVE-2026-7481](https://nvd.nist.gov/vuln/detail/CVE-2026-7481) | High | Global search / search-results frontend (Vue): blob/code search result headers and search autocomplete/command-palette rendering | [`92771d28`](https://gitlab.com/gitlab-org/gitlab/-/commit/92771d281a6cfd979e2cb5798822f0558ee30800) | | 2026-06-10 | [CVE-2026-10733](https://nvd.nist.gov/vuln/detail/CVE-2026-10733) | Medium | CI/CD Catalog (frontend markdown rendering of catalog resource descriptions) | [`63b1823f`](https://gitlab.com/gitlab-org/gitlab/-/commit/63b1823fb94c09e232c16a33e1781779a9e179e2) | | 2026-06-10 | [CVE-2026-8589](https://nvd.nist.gov/vuln/detail/CVE-2026-8589) | High | EE Audit Events - audit log 'Action' column rendering (ee/app/assets/javascripts/audit_events) | [`2723b0b5`](https://gitlab.com/gitlab-org/gitlab/-/commit/2723b0b5815c1578819586763822a473465c60a0) | ### G3. Operations run under / authorize against a wrong or attacker-influenced identity *recurring, 15 findings* **Root cause.** CI pipelines and issue operations execute under an identity derived from push origin, project ownership, commit.author email, target-branch change, environment-stop trigger, or a composite AI identity rather than the authenticated triggering actor, and the CI authorization subject is built from attacker-controlled ref/pipeline inputs, so attacker CI/actions run with victim privileges. **Prevent.** Triggered CI/actions must run as the resolved authenticated actor; a guard forbids using push-origin/owner/commit-author as current_user for authorization; tests per trigger path. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2024-05-21 | [CVE-2024-5258](https://nvd.nist.gov/vuln/detail/CVE-2024-5258) | Medium | ci-cd / commit-status API (Ci::CreateCommitStatusService) | [`ff4bb525`](https://gitlab.com/gitlab-org/gitlab/-/commit/ff4bb525a3b8714f9559559d067665630ec5b391) | | 2024-06-25 | [CVE-2024-5655](https://nvd.nist.gov/vuln/detail/CVE-2024-5655) | Critical | merge_requests / CI pipelines (automatic MR re-targeting on target-branch deletion) | [`f68c020c`](https://gitlab.com/gitlab-org/gitlab/-/commit/f68c020c8d2a2dc53187a65857f3312a025af3f4) | | 2024-08-06 | [CVE-2024-6356](https://nvd.nist.gov/vuln/detail/CVE-2024-6356) | Medium | Security orchestration policies / authorization (EE ProjectPolicy) - Security Policy Bot | [`0de6ffe0`](https://gitlab.com/gitlab-org/gitlab/-/commit/0de6ffe017e4b400641889ac1ea83d903265c10a) | | 2024-08-20 | [CVE-2024-7110](https://nvd.nist.gov/vuln/detail/CVE-2024-7110) | Medium | GitLab Duo Vulnerability Resolution (AI-assisted vulnerability remediation MR creation, EE) | [`80cb299c`](https://gitlab.com/gitlab-org/gitlab/-/commit/80cb299c28296646c4c8b7dfa1cbee8f2fe9a68b) | | 2024-09-11 | [CVE-2024-6678](https://nvd.nist.gov/vuln/detail/CVE-2024-6678) | Critical | CI/CD environments — environment stop actions (deployment teardown jobs) | [`8ff8085f`](https://gitlab.com/gitlab-org/gitlab/-/commit/8ff8085ff4f2fd49cf8c6ae205ee0c31349e970c) | | 2024-09-11 | [CVE-2024-8311](https://nvd.nist.gov/vuln/detail/CVE-2024-8311) | Medium | ci-cd / security-orchestration (Pipeline Execution Policies, EE) | [`4f50f93a`](https://gitlab.com/gitlab-org/gitlab/-/commit/4f50f93aa73c69bf3076bbb1ea840a130d344b50) | | 2024-10-09 | [CVE-2024-8970](https://nvd.nist.gov/vuln/detail/CVE-2024-8970) | High | Merge requests / CI pipelines (MergeRequests::RefreshService detached MR pipeline creation) | [`3dd89a71`](https://gitlab.com/gitlab-org/gitlab/-/commit/3dd89a71b436e8218a5d159a1dd75cb2de078129) | | 2024-10-09 | [CVE-2024-9164](https://nvd.nist.gov/vuln/detail/CVE-2024-9164) | Critical | CI/CD pipelines + merge requests (MergeRequests::RefreshService / detached MR pipeline creation) | [`480d0bd7`](https://gitlab.com/gitlab-org/gitlab/-/commit/480d0bd7ccdca6f93ff715abcd6c2fa7a9bebec2) | | 2024-10-16 | [CVE-2024-7102](https://nvd.nist.gov/vuln/detail/CVE-2024-7102) | Critical | CI/CD merge-request pipelines (MergeRequests::RefreshService on branch push) | [`480d0bd7`](https://gitlab.com/gitlab-org/gitlab/-/commit/480d0bd7ccdca6f93ff715abcd6c2fa7a9bebec2) | | 2024-11-20 | [CVE-2024-8266](https://nvd.nist.gov/vuln/detail/CVE-2024-8266) | Medium | Container registry push handling -> Container Scanning For Registry (AppSec) auto-triggered CI pipeline (EE Ultimate) | not publicly recorded | | 2025-01-08 | [CVE-2024-12431](https://nvd.nist.gov/vuln/detail/CVE-2024-12431) | Medium | Issues / commit auto-close (Issues::CloseWorker + ProcessCommitWorker) | [`92c10374`](https://gitlab.com/gitlab-org/gitlab/-/commit/92c10374afb3a86ee76c149202204a642f8702ae) | | 2025-03-26 | [CVE-2025-2867](https://nvd.nist.gov/vuln/detail/CVE-2025-2867) | Medium | CI/CD pipeline creation — GitLab Duo with Amazon Q composite identity (Ci::CreatePipelineService validation chain) | [`d9968022`](https://gitlab.com/gitlab-org/gitlab/-/commit/d996802255df23ea7857868ce1375efb6883c525) | | 2025-08-12 | [CVE-2025-5819](https://nvd.nist.gov/vuln/detail/CVE-2025-5819) | Medium | CI/CD - CI ID Tokens (OIDC JWT) generation for merge-request pipelines | [`7e9f329e`](https://gitlab.com/gitlab-org/gitlab/-/commit/7e9f329e8f6a33ffe3a63f8f64016d9b35b06a09) | | 2025-10-21 | [CVE-2025-11971](https://nvd.nist.gov/vuln/detail/CVE-2025-11971) | Medium | CI/CD pipeline creation authorization (EE) - pull-mirror-triggered builds | [`aa119ee4`](https://gitlab.com/gitlab-org/gitlab/-/commit/aa119ee4549f) | | 2025-11-25 | [CVE-2024-9183](https://nvd.nist.gov/vuln/detail/CVE-2024-9183) | High | CI/CD runner job cache (Ci::Build cache key derivation / separated caches) | [`ed37cd8d`](https://gitlab.com/gitlab-org/gitlab/-/commit/ed37cd8dd971dec027a7be0675272a264c63fbda) | ### G4. No bound on outbound HTTP response size/element/decompression *recurring, 15 findings* **Root cause.** The shared outbound HTTP client and importer/integration/webhook consumers fully buffer and deserialize responses from attacker-influenced servers (importers, webhooks, registries, retry-notice bodies) with no ceiling on body size, gzip-decompressed size, element/nesting count, interim 1xx count, or CSV/XML rows; guards were off-by-default or JSON-only. **Prevent.** The shared HTTP client aborts once any response exceeds the byte/element/row/1xx bound; no consumer may parse a raw response body out-of-band of it. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2024-08-20 | [CVE-2024-8041](https://nvd.nist.gov/vuln/detail/CVE-2024-8041) | Medium | GitHub importer (Octokit API client / Faraday middleware stack) | [`5a9474dd`](https://gitlab.com/gitlab-org/gitlab/-/commit/5a9474ddfcd29ae71df06bb36f7ed3c995252da0) | | 2024-11-12 | [CVE-2025-1072](https://nvd.nist.gov/vuln/detail/CVE-2025-1072) | Medium | FogBugz project importer (Import::FogbugzController + lib/gitlab/fogbugz_import client/XML parsing) | [`3880dcd2`](https://gitlab.com/gitlab-org/gitlab/-/commit/3880dcd2b426d3bbc384dbdb3146935c643a30af) | | 2024-11-26 | [CVE-2024-8177](https://nvd.nist.gov/vuln/detail/CVE-2024-8177) | Medium | Harbor container-registry integration (lib/gitlab/harbor client + Projects/Groups Harbor controllers) | [`30ae381d`](https://gitlab.com/gitlab-org/gitlab/-/commit/30ae381d5f8a02d14f2be63ca5150de2852a206a) | | 2025-05-07 | [CVE-2024-8973](https://nvd.nist.gov/vuln/detail/CVE-2024-8973) | Medium | GitHub project importer / Octokit response-validation Faraday middleware | [`dbf91625`](https://gitlab.com/gitlab-org/gitlab/-/commit/dbf91625730119709829caf0de36a1a0a85e1cca) | | 2025-05-21 | [CVE-2024-7803](https://nvd.nist.gov/vuln/detail/CVE-2024-7803) | Medium | Integrations :: Discord chat notification (app/models/concerns/integrations/base/discord.rb) | [`d24760cb`](https://gitlab.com/gitlab-org/gitlab/-/commit/d24760cb6a934838765021a3d5ae14d8b8f00ed7) | | 2025-05-21 | [CVE-2025-5996](https://nvd.nist.gov/vuln/detail/CVE-2025-5996) | Medium | Outbound HTTP client shared by third-party integrations, webhooks and importers (gitlab-http gem / Gitlab::HTTP) | [`f8bf8082`](https://gitlab.com/gitlab-org/gitlab/-/commit/f8bf80825e1bd802be7be374905600059abd2726) | | 2025-08-26 | [CVE-2025-3601](https://nvd.nist.gov/vuln/detail/CVE-2025-3601) | Medium | Project import (Gitea importer) — app/controllers/import | [`d3d5f8e5`](https://gitlab.com/gitlab-org/gitlab/-/commit/d3d5f8e5ca2c9d443ea6851628e5e20d02af877d) | | 2025-10-08 | [CVE-2025-2934](https://nvd.nist.gov/vuln/detail/CVE-2025-2934) | Medium | Outbound HTTP client stack (Gitlab::HTTP / Net::HTTP) used by webhooks and integrations | [`f978de54`](https://gitlab.com/gitlab-org/gitlab/-/commit/f978de547519e0c03c05db051d7566f28dde3b80) | | 2025-11-25 | [CVE-2025-7449](https://nvd.nist.gov/vuln/detail/CVE-2025-7449) | Medium | Gitlab::HTTP outbound HTTP client / HTTParty JSON response parsing (webhooks & external integrations) | [`b1250e0c`](https://gitlab.com/gitlab-org/gitlab/-/commit/b1250e0c8e4c9c1434f1d39bfd109f48a2541bfa) | | 2026-01-07 | [CVE-2025-10569](https://nvd.nist.gov/vuln/detail/CVE-2025-10569) | Medium | lib/gitlab HTTP client (Gitlab::HTTP / HTTParty response parsing) — Gitlab::HttpResponseParser XML and CSV parse paths | [`c6d0c137`](https://gitlab.com/gitlab-org/gitlab/-/commit/c6d0c137d76c) | | 2026-02-24 | [CVE-2026-2845](https://nvd.nist.gov/vuln/detail/CVE-2026-2845) | Medium | Project importers - Bitbucket Server import controller (app/controllers/import/bitbucket_server_controller.rb) | [`fe8e8b63`](https://gitlab.com/gitlab-org/gitlab/-/commit/fe8e8b63ca6d73535c550d6261c274d1f528d98c) | | 2026-03-10 | [CVE-2025-12576](https://nvd.nist.gov/vuln/detail/CVE-2025-12576) | Medium | webhooks (project/group/admin hook logs - retry/resend endpoint) | [`b004740f`](https://gitlab.com/gitlab-org/gitlab/-/commit/b004740fd368fec28c0cafa7581e6d3f024335a1) | | 2026-04-21 | [CVE-2026-1660](https://nvd.nist.gov/vuln/detail/CVE-2026-1660) | Medium | Jira import / Gitlab::HTTP response parsing (lib/gitlab/http_response_parser.rb) | [`8d758143`](https://gitlab.com/gitlab-org/gitlab/-/commit/8d75814365ab1623d360ed71755eb67dae56ccf6) | | 2026-05-13 | [CVE-2026-8280](https://nvd.nist.gov/vuln/detail/CVE-2026-8280) | Medium | Outbound HTTP response parsing / response-size limiting (Gitlab::HTTP -> Gitlab::HttpResponseParser, HTTParty parser) | [`4a68f4e3`](https://gitlab.com/gitlab-org/gitlab/-/commit/4a68f4e38966533fb9a9daa3eabc17a56a6b2f7b) | | 2026-06-10 | [CVE-2026-1500](https://nvd.nist.gov/vuln/detail/CVE-2026-1500) | Medium | Import / User Mapping - placeholder (source-user) reassignment CSV upload (Groups::BulkPlaceholderAssignmentsController + API::GroupPlaceholderReassignments) | [`3615da8b`](https://gitlab.com/gitlab-org/gitlab/-/commit/3615da8bbaec9f0bb185083135f31b5612896176) | ### G5. Backtracking regex run on untrusted input with no complexity bound *recurring, 15 findings* **Root cause.** User-controlled strings (ref/search patterns, CI YAML, file content, commit messages, marketing params) are matched with native backtracking Ruby/Onigmo regexes built from unbounded or user-expanded quantifiers, with no linear-time engine, anchoring, or input-length/time cap, so crafted input causes catastrophic backtracking. **Prevent.** A lint/guard flags native-regex matches against attacker input; such matches must use RE2 or a bounded-time wrapper. CI benchmark on adversarial inputs. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2024-04-24 | [CVE-2024-2829](https://nvd.nist.gov/vuln/detail/CVE-2024-2829) | High | Code/blob search — Gitlab::FileFinder wildcard filter matching | [`b1b91959`](https://gitlab.com/gitlab-org/gitlab/-/commit/b1b91959494a16036c361e22e1d3caffd874cc02) | | 2024-05-07 | [CVE-2024-2651](https://nvd.nist.gov/vuln/detail/CVE-2024-2651) | Medium | Banzai markdown rendering pipeline (lib/banzai/filter) - escape filters and reference filters | [`186bda71`](https://gitlab.com/gitlab-org/gitlab/-/commit/186bda71e1bbcf542effee18a14d1a7261b0b12d) | | 2024-05-07 | [CVE-2024-2878](https://nvd.nist.gov/vuln/detail/CVE-2024-2878) | High | Repository branch/tag search — GitRefsFinder (BranchesFinder / TagsFinder) | [`844ad9c3`](https://gitlab.com/gitlab-org/gitlab/-/commit/844ad9c3f404a0a838b895d4ac9b7dc7493bd291) | | 2024-06-11 | [CVE-2024-1495](https://nvd.nist.gov/vuln/detail/CVE-2024-1495) | Medium | Repository blob rendering / dependency linker (Gitlab::DependencyLinker::GoModLinker, go_package_regex) | [`f3f4a536`](https://gitlab.com/gitlab-org/gitlab/-/commit/f3f4a536983f296c1c5bf2e63a4a69d6818578be) | | 2024-06-11 | [CVE-2024-1736](https://nvd.nist.gov/vuln/detail/CVE-2024-1736) | Medium | CI/CD pipeline configuration — inputs interpolation (Gitlab::Ci::Config::Interpolation) | [`03f36b94`](https://gitlab.com/gitlab-org/gitlab/-/commit/03f36b94893d239a45525ba8f49255864fea0e2e) | | 2024-06-11 | [CVE-2024-1963](https://nvd.nist.gov/vuln/detail/CVE-2024-1963) | Medium | Integrations :: Asana (project push integration / commit-message issue mapping) | [`97f67a7e`](https://gitlab.com/gitlab-org/gitlab/-/commit/97f67a7ecd39e1e7c6cbfefb652ae3e170b7b114) | | 2024-06-25 | [CVE-2024-1493](https://nvd.nist.gov/vuln/detail/CVE-2024-1493) | Medium | Gitlab::DependencyLinker (blob dependency-file link generation in lib/gitlab/dependency_linker/) | [`6e3fb9ff`](https://gitlab.com/gitlab-org/gitlab/-/commit/6e3fb9ff027fa56e62db093c4291c5d562550c2d) | | 2024-06-25 | [CVE-2024-1816](https://nvd.nist.gov/vuln/detail/CVE-2024-1816) | Medium | repository file-type detection (Gitlab::FileDetector) used by blob rich-viewer selection and push branch-hooks | [`6561fa18`](https://gitlab.com/gitlab-org/gitlab/-/commit/6561fa187bd297a664c7fee8d1bbb546fb6f197e) | | 2024-06-25 | [CVE-2024-4025](https://nvd.nist.gov/vuln/detail/CVE-2024-4025) | Medium | Banzai markdown rendering pipeline (lib/banzai/filter/autolink_filter.rb) | [`74014108`](https://gitlab.com/gitlab-org/gitlab/-/commit/74014108b6811c8ea40813e0981915115742a1d4) | | 2024-08-06 | [CVE-2024-2800](https://nvd.nist.gov/vuln/detail/CVE-2024-2800) | Medium | Protected refs / branch-name matching (RefMatcher model) | [`71a408dd`](https://gitlab.com/gitlab-org/gitlab/-/commit/71a408dd12b9a96d6713644938f59d3e7d36f738) | | 2024-08-06 | [CVE-2024-3114](https://nvd.nist.gov/vuln/detail/CVE-2024-3114) | Medium | source-code-management / git push handling (Gitlab::PushOptions parsing in the internal API git-access path) | [`1286b588`](https://gitlab.com/gitlab-org/gitlab/-/commit/1286b58893505391bb33e915f25bcc00ea1184e2) | | 2024-08-06 | [CVE-2024-7610](https://nvd.nist.gov/vuln/detail/CVE-2024-7610) | Medium | Advanced Search (Elasticsearch) blob search result parsing (EE) | [`9757b254`](https://gitlab.com/gitlab-org/gitlab/-/commit/9757b254a51d) | | 2024-09-11 | [CVE-2024-8124](https://nvd.nist.gov/vuln/detail/CVE-2024-8124) | High | PreferredLanguageSwitcher controller concern (i18n locale switching on unauthenticated pages via the global ApplicationController around_action :set_locale) | [`9ab1ddbd`](https://gitlab.com/gitlab-org/gitlab/-/commit/9ab1ddbdb4d3d0a026e42d5972a00962c1e900ae) | | 2024-12-10 | [CVE-2024-9367](https://nvd.nist.gov/vuln/detail/CVE-2024-9367) | Medium | Changelog generation / template parsing (Repositories API) | [`f974f850`](https://gitlab.com/gitlab-org/gitlab/-/commit/f974f850463f267b5a636f28c99cac61c4ef6259) | | 2026-02-24 | [CVE-2026-1388](https://nvd.nist.gov/vuln/detail/CVE-2026-1388) | High | Rails routing / URL path recognition (Gitlab::PathRegex namespace-route constraint used by the project/merge-request wildcard routes) | [`eaca0440`](https://gitlab.com/gitlab-org/gitlab/-/commit/eaca044043c41c0485b461d926fa4aa425c95d1d) | ### G6. Request-body deserialization resource limits are opt-in and bypassable *recurring, 13 findings* **Root cause.** The JsonValidation middleware bounds request-body size/element-count only for routes on a hand-maintained allowlist, defaults max_json_size_bytes to 0 (disabled), gates on client Content-Type, and runs before authentication; endpoints that parse JSON out-of-band, declare vendor content types, omit Content-Type, or accept large Grape String params bypass it entirely. **Prevent.** No unauthenticated endpoint may deserialize a request body without a body-size/element bound; the cap is default-on and content-type-agnostic, asserted by an integration test sweeping route classes. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2024-05-07 | [CVE-2024-2454](https://nvd.nist.gov/vuln/detail/CVE-2024-2454) | Medium | Users navigation pins controller (app/controllers/users/pins_controller.rb) — Rails REST endpoint PUT/PATCH /-/users/pins | [`996b8bd9`](https://gitlab.com/gitlab-org/gitlab/-/commit/996b8bd92242f7c549bfb624b288cd2c4042ecb2) | | 2025-09-25 | [CVE-2025-10858](https://nvd.nist.gov/vuln/detail/CVE-2025-10858) | High | Rack/Rails request pipeline for JSON request bodies (global param parsing); notably the Terraform state upload API and the Packages (NPM) security-audit endpoints. | [`4ac90fb1`](https://gitlab.com/gitlab-org/gitlab/-/commit/4ac90fb14a01) | | 2025-10-21 | [CVE-2025-10497](https://nvd.nist.gov/vuln/detail/CVE-2025-10497) | High | EventForward / product-analytics event collection (`POST /-/collect_events`) + `Gitlab::Middleware::JsonValidation` Rack middleware | [`eabab1c4`](https://gitlab.com/gitlab-org/gitlab/-/commit/eabab1c4adb4919b4bcd0211b8bb0b7263cb0a76) | | 2025-10-21 | [CVE-2025-11974](https://nvd.nist.gov/vuln/detail/CVE-2025-11974) | Medium | Product analytics event-forwarding endpoint (/-/collect_events) + JsonValidation Rack middleware | [`857eb101`](https://gitlab.com/gitlab-org/gitlab/-/commit/857eb101355e) | | 2025-11-25 | [CVE-2025-12571](https://nvd.nist.gov/vuln/detail/CVE-2025-12571) | High | JSON request parsing / Gitlab::Json helper + JsonValidation middleware | [`a6e2e73e`](https://gitlab.com/gitlab-org/gitlab/-/commit/a6e2e73efc6ec9bdb0eb34c492d2a55d2f149725) | | 2025-12-10 | [CVE-2025-14157](https://nvd.nist.gov/vuln/detail/CVE-2025-14157) | Medium | Repository REST API (commits & files write endpoints) | [`5413d2b3`](https://gitlab.com/gitlab-org/gitlab/-/commit/5413d2b38ae6dde76cadf981d986cf48b88daa20) | | 2026-02-09 | [CVE-2026-0958](https://nvd.nist.gov/vuln/detail/CVE-2026-0958) | High | JSON request-validation Rack middleware (Gitlab::Middleware::JsonValidation + Gitlab::Json::StreamValidator streaming limit enforcer) | [`a6edb1e0`](https://gitlab.com/gitlab-org/gitlab/-/commit/a6edb1e031a4383aa88f0902d5f8150492c34972) | | 2026-02-24 | [CVE-2025-14511](https://nvd.nist.gov/vuln/detail/CVE-2025-14511) | High | container-registry-event-api / JSON request-validation middleware | [`3527ac7e`](https://gitlab.com/gitlab-org/gitlab/-/commit/3527ac7ed5f5d1f55d5e990c81b5197a323a2ef3) | | 2026-03-10 | [CVE-2025-14513](https://nvd.nist.gov/vuln/detail/CVE-2025-14513) | High | REST API - Protected Branches / Protected Tags (Grape) + Gitlab::Middleware::JsonValidation Rack middleware | [`54c2233e`](https://gitlab.com/gitlab-org/gitlab/-/commit/54c2233e9d062012c818181853a21e97a05d31ff) | | 2026-04-07 | [CVE-2026-1092](https://nvd.nist.gov/vuln/detail/CVE-2026-1092) | High | Workhorse reverse proxy / Terraform state REST API (infrastructure_as_code) | [`7a38afa9`](https://gitlab.com/gitlab-org/gitlab/-/commit/7a38afa9632f7f7553630817271dd56842a2d378) | | 2026-05-13 | [CVE-2025-14869](https://nvd.nist.gov/vuln/detail/CVE-2025-14869) | High | API request handling / JSON input validation middleware (Gitlab::Middleware::JsonValidation) applied to the Duo Workflow / Agent Platform API (/api/v4/ai/duo_workflows/...) | [`3113a34e`](https://gitlab.com/gitlab-org/gitlab/-/commit/3113a34ed95827dc7193afa199393bda5e53bdee) | | 2026-05-13 | [CVE-2025-14870](https://nvd.nist.gov/vuln/detail/CVE-2025-14870) | High | JSON request-validation middleware (Gitlab::Middleware::JsonValidation) guarding the Duo Workflow REST API (/api/v4/ai/duo_workflows/workflows/*) | [`3113a34e`](https://gitlab.com/gitlab-org/gitlab/-/commit/3113a34ed95827dc7193afa199393bda5e53bdee) | | 2026-06-10 | [CVE-2026-7250](https://nvd.nist.gov/vuln/detail/CVE-2026-7250) | High | Rack middleware / API request body JSON validation (Gitlab::Middleware::JsonValidation) | [`c9b271bf`](https://gitlab.com/gitlab-org/gitlab/-/commit/c9b271bfba59e0464d7e7eed7344aab14b825aa3) | ### G7. GraphQL fields/types default to no field-level authorization *recurring, 13 findings* **Root cause.** GraphQL fields default to no authorization unless authorize: is set, several types (CiJob, AiFeatureSetting) deliberately opt out of type-level authz and push the decision onto each field, and per-field guards, entity exposures, or subtree-scoped skip_type_authorization were omitted, exposing sensitive fields to coarse object-read. **Prevent.** A schema lint requires an explicit authorize:/read-ability on every field exposing sensitive data, especially on types that opt out of type-level authz; CI check. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2024-07-24 | [CVE-2024-5067](https://nvd.nist.gov/vuln/detail/CVE-2024-5067) | Medium | EE Product Analytics / Combined Analytics Dashboards (ee/app/helpers/analytics) | [`9925a8a3`](https://gitlab.com/gitlab-org/gitlab/-/commit/9925a8a3989b8bda4ca0c76b1002c25a911c2326) | | 2024-11-12 | [CVE-2024-10240](https://nvd.nist.gov/vuln/detail/CVE-2024-10240) | Medium | EE Merge Request Dependencies API (blocking/blocked merge requests) — Grape API + entity serializer | [`3ed2ec16`](https://gitlab.com/gitlab-org/gitlab/-/commit/3ed2ec16854bec0b0463207c3c2c604af0635ddb) | | 2024-12-10 | [CVE-2024-8116](https://nvd.nist.gov/vuln/detail/CVE-2024-8116) | Medium | GraphQL API - ProjectType (protectableBranches field) | [`9d856d29`](https://gitlab.com/gitlab-org/gitlab/-/commit/9d856d297b1d7bc903988eb604077fe982056e31) | | 2025-04-22 | [CVE-2024-12244](https://nvd.nist.gov/vuln/detail/CVE-2024-12244) | Medium | GraphQL API — EE DAST on-demand scans (Dast::ProfileType) | [`cb099873`](https://gitlab.com/gitlab-org/gitlab/-/commit/cb09987371857b97ec3cc5774b9f214c9db7c8a6) | | 2025-05-21 | [CVE-2025-1110](https://nvd.nist.gov/vuln/detail/CVE-2025-1110) | Low | CI/CD job trace exposure via GraphQL API (Types::Ci::JobType / Types::Ci::JobInterface field-level authorization) | [`863e0123`](https://gitlab.com/gitlab-org/gitlab/-/commit/863e01239a13246c001c2b5e6dd431e16ff90b52) | | 2025-07-22 | [CVE-2025-1299](https://nvd.nist.gov/vuln/detail/CVE-2025-1299) | Medium | GraphQL API - CI/CD deployments (Types::DeploymentType.job -> Types::Ci::JobType) | [`14ccab85`](https://gitlab.com/gitlab-org/gitlab/-/commit/14ccab850f5a380811dd495aeec0b035dadfc288) | | 2025-08-26 | [CVE-2025-2246](https://nvd.nist.gov/vuln/detail/CVE-2025-2246) | Medium | CI/CD GraphQL API (Types::Ci::JobType manual_variables field / Ci::BuildPolicy) | [`bc1a7ab6`](https://gitlab.com/gitlab-org/gitlab/-/commit/bc1a7ab637631457e5d95b5bc0236d2f78b62eb8) | | 2025-09-09 | [CVE-2025-6769](https://nvd.nist.gov/vuln/detail/CVE-2025-6769) | Medium | CI runners (fleet visibility) - REST API runner entity + GraphQL RunnerType | [`00cc23a6`](https://gitlab.com/gitlab-org/gitlab/-/commit/00cc23a68e37a8e67822ba2cb68ec643003fb228) | | 2025-09-25 | [CVE-2025-9958](https://nvd.nist.gov/vuln/detail/CVE-2025-9958) | High | Package Registry - Maven Virtual Registry (GraphQL API) | [`2b9dc66b`](https://gitlab.com/gitlab-org/gitlab/-/commit/2b9dc66b0ae4702bb5285a30db0eb728b44370bf) | | 2025-10-08 | [CVE-2025-9825](https://nvd.nist.gov/vuln/detail/CVE-2025-9825) | Medium | CI/CD build authorization policy (GraphQL Ci::JobType manualVariables field) | [`2dfe8c36`](https://gitlab.com/gitlab-org/gitlab/-/commit/2dfe8c36e7b9ddc3a64084eca2e6ba12d991d97b) | | 2025-11-11 | [CVE-2025-6171](https://nvd.nist.gov/vuln/detail/CVE-2025-6171) | Medium | Package Registry REST API (Grape) — lib/api project package/package-file entities and endpoints | [`64c2516e`](https://gitlab.com/gitlab-org/gitlab/-/commit/64c2516e6106fc3d9b5a4adc8888891b56a05476) | | 2025-12-10 | [CVE-2025-11247](https://nvd.nist.gov/vuln/detail/CVE-2025-11247) | Medium | GraphQL API - EE Compliance Management (compliance_frameworks field on ProjectType) | [`196c2ee9`](https://gitlab.com/gitlab-org/gitlab/-/commit/196c2ee92ee6f4addb46fd2c0ae98904989c326e) | | 2026-05-26 | [CVE-2026-6713](https://nvd.nist.gov/vuln/detail/CVE-2026-6713) | Medium | GraphQL API type-level authorization (WorkItem -> Project traversal) | [`1661207c`](https://gitlab.com/gitlab-org/gitlab/-/commit/1661207c53118847e7d56c6f0c270c0f4a1aa691) | ### G8. No forced-inert boundary for untrusted bytes served on the GitLab origin *recurring, 13 findings* **Root cause.** GitLab serves attacker-influenced bytes (raw blobs, dependency-proxy/registry upstream content, KAS/Workhorse-proxied responses) under its own trusted origin and relies solely on response headers to keep them inert; there is no shared control that forces attachment disposition, strips/allowlists forwarded upstream headers, or applies a uniform sandbox CSP, so header gaps or browser sniffing execute content in-origin. **Prevent.** Every raw-blob or upstream-proxy response passes through one egress helper that allowlists response headers and forces inert rendering; no proxy handler may copy upstream headers verbatim. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2024-06-11 | [CVE-2024-4201](https://nvd.nist.gov/vuln/detail/CVE-2024-4201) | Medium | source_code_management / raw blob serving (Projects::RawController + WorkhorseHelper Content-Disposition) | [`836d5100`](https://gitlab.com/gitlab-org/gitlab/-/commit/836d5100c658387f88f7cb0bcde23df38abef18c) | | 2024-07-24 | [CVE-2024-7047](https://nvd.nist.gov/vuln/detail/CVE-2024-7047) | High | Package Registry - Maven dependency (packages) proxy (ee/lib/api/dependency_proxy + Workhorse send_url/send_dependency) | [`2b160f8f`](https://gitlab.com/gitlab-org/gitlab/-/commit/2b160f8fa7ac30f840e38b11098499762f351f07) | | 2024-08-06 | [CVE-2024-4207](https://nvd.nist.gov/vuln/detail/CVE-2024-4207) | Medium | source_code_management / repository raw blob serving (Grape API helper send_git_blob) | [`4952960a`](https://gitlab.com/gitlab-org/gitlab/-/commit/4952960acf3b3b133c29454375fcbb1e3850ee44) | | 2024-12-10 | [CVE-2024-11274](https://nvd.nist.gov/vuln/detail/CVE-2024-11274) | High | GitLab Agent Server for Kubernetes (KAS) user-access k8s API proxy | [`d9b00325`](https://gitlab.com/gitlab-org/gitlab/-/commit/d9b003250d7e) | | 2025-02-11 | [CVE-2025-1212](https://nvd.nist.gov/vuln/detail/CVE-2025-1212) | Medium | GitLab Workhorse (reverse-proxy in front of Rails/Puma) — request routing and Rails response pass-through | [`dd5fb5b4`](https://gitlab.com/gitlab-org/gitlab/-/commit/dd5fb5b4e217868aa8602acee276883ae8e42126) | | 2025-02-26 | [CVE-2025-0475](https://nvd.nist.gov/vuln/detail/CVE-2025-0475) | High | Package Registry / Maven dependency proxy (EE) — Grape API endpoint that proxies and caches package files from an external Maven upstream registry. | [`1801feb9`](https://gitlab.com/gitlab-org/gitlab/-/commit/1801feb9cee23ee0e40b4118f92b85c0a16ade78) | | 2025-02-26 | [CVE-2025-0555](https://nvd.nist.gov/vuln/detail/CVE-2025-0555) | High | Package Registry / Dependency Proxy (Maven virtual registry) - GitLab EE | [`1801feb9`](https://gitlab.com/gitlab-org/gitlab/-/commit/1801feb9cee23ee0e40b4118f92b85c0a16ade78) | | 2025-04-22 | [CVE-2025-1763](https://nvd.nist.gov/vuln/detail/CVE-2025-1763) | High | Package Registry / Maven packages dependency proxy (EE) + GitLab Workhorse response-header forwarding | [`24d73f3e`](https://gitlab.com/gitlab-org/gitlab/-/commit/24d73f3e778471c4e0153af174f2d8b44e106108) | | 2025-04-22 | [CVE-2025-1908](https://nvd.nist.gov/vuln/detail/CVE-2025-1908) | High | Rack/Rails response middleware pipeline (HTTP response headers); config/application.rb + lib/gitlab/middleware | [`5e9112ba`](https://gitlab.com/gitlab-org/gitlab/-/commit/5e9112ba2d6fac340e1dbfc4b0330bdcff2f82bc) | | 2025-04-22 | [CVE-2025-2443](https://nvd.nist.gov/vuln/detail/CVE-2025-2443) | High | EE package registry - Maven dependency (virtual) proxy; GitLab Workhorse send_url/dependencyproxy response streaming | [`24d73f3e`](https://gitlab.com/gitlab-org/gitlab/-/commit/24d73f3e778471c4e0153af174f2d8b44e106108) | | 2025-07-22 | [CVE-2025-4439](https://nvd.nist.gov/vuln/detail/CVE-2025-4439) | High | HTTP response / static-content serving behind a CDN (Content-Type / anti-MIME-sniffing response-header handling). Unconfirmed from code — the fix for this CVE was not published to the public gitlab-org/gitlab mirror. | not publicly recorded | | 2025-11-11 | [CVE-2025-11224](https://nvd.nist.gov/vuln/detail/CVE-2025-11224) | High | GitLab Agent for Kubernetes (KAS) — Kubernetes API proxy (group::environments) | not publicly recorded | | 2026-01-07 | [CVE-2025-3950](https://nvd.nist.gov/vuln/detail/CVE-2025-3950) | Low | Banzai markdown rendering pipeline — Mermaid diagram filter / asset proxy (Camo) protection | [`a0c95aed`](https://gitlab.com/gitlab-org/gitlab/-/commit/a0c95aed2a4700d5d4fffbaa77e2a4a392c1ea62) | ### G9. A read-level ability/scope guards a state-changing operation *recurring, 12 findings* **Root cause.** Mutating/settings-write operations (vulnerability flags, compliance violations, AI feature settings, deploy tokens, analytics/markdown-upload writes, note-email token, DAST secret exposure) are gated only by a coarse read ability, a read_api OAuth scope, or a view-page permission, so a read-authorized (auditor/guest/self-service) actor performs a write. **Prevent.** Every mutating endpoint/mutation authorizes a write-specific ability with :api scope; a policy audit test flags read-ability gates on writes. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2024-01-24 | [CVE-2024-0456](https://nvd.nist.gov/vuln/detail/CVE-2024-0456) | Medium | merge_requests / issuable authorization (assignees & reviewers services) | [`d07effe7`](https://gitlab.com/gitlab-org/gitlab/-/commit/d07effe7a35c911e429e0964ded79b8edb049bf8) | | 2024-02-20 | [CVE-2024-0861](https://nvd.nist.gov/vuln/detail/CVE-2024-0861) | Medium | Project analytics dashboards settings (EE) — Projects::Settings::AnalyticsController | [`eaff749a`](https://gitlab.com/gitlab-org/gitlab/-/commit/eaff749ab0ff501f1eae69ef7f3d5a141c02924c) | | 2024-07-09 | [CVE-2024-5257](https://nvd.nist.gov/vuln/detail/CVE-2024-5257) | Medium | Groups general settings authorization (EE GroupsController) / custom-role RBAC | [`30cc4e83`](https://gitlab.com/gitlab-org/gitlab/-/commit/30cc4e834c300d18d4e30f052de18f999065ae85) | | 2024-07-09 | [CVE-2024-5470](https://nvd.nist.gov/vuln/detail/CVE-2024-5470) | Low | Project repository settings / deploy tokens (EE controller authorization) | [`38d7fcbd`](https://gitlab.com/gitlab-org/gitlab/-/commit/38d7fcbde55100c6eb63a1c8babd379cb4d205a3) | | 2025-06-24 | [CVE-2025-1754](https://nvd.nist.gov/vuln/detail/CVE-2025-1754) | Medium | REST API - Markdown/project uploads (lib/api/markdown_uploads.rb, Grape API::MarkdownUploads) | [`c96e37a8`](https://gitlab.com/gitlab-org/gitlab/-/commit/c96e37a82f781967214e76f8f348039e2bf46398) | | 2025-10-08 | [CVE-2025-11340](https://nvd.nist.gov/vuln/detail/CVE-2025-11340) | High | GraphQL API authorization — EE Security/Vulnerability Management mutations (token OAuth scope enforcement) | [`a2c70f53`](https://gitlab.com/gitlab-org/gitlab/-/commit/a2c70f53fde77761905c184021dba0a1c74013c8) | | 2026-01-07 | [CVE-2025-13781](https://nvd.nist.gov/vuln/detail/CVE-2025-13781) | Medium | GraphQL API - AI feature settings mutations (ee/app/graphql/mutations/ai/feature_settings) | [`6da3f338`](https://gitlab.com/gitlab-org/gitlab/-/commit/6da3f338cc1a27a8d93e9481c931a75436e4ab63) | | 2026-03-24 | [CVE-2026-1724](https://nvd.nist.gov/vuln/detail/CVE-2026-1724) | Medium | EE GraphQL API - GitLab Duo Self-Hosted AI model feature settings (ee/app/graphql/resolvers/ai/feature_settings) | [`32836e4f`](https://gitlab.com/gitlab-org/gitlab/-/commit/32836e4faf7a919452328d0d33dd358279c37c2b) | | 2026-04-07 | [CVE-2026-2619](https://nvd.nist.gov/vuln/detail/CVE-2026-2619) | Medium | vulnerability_management (Vulnerability Flags API / AI SAST false-positive detection) | [`37fa01da`](https://gitlab.com/gitlab-org/gitlab/-/commit/37fa01da5b0ca32cb34b37c6d70e5a393110cbd1) | | 2026-05-13 | [CVE-2026-1322](https://nvd.nist.gov/vuln/detail/CVE-2026-1322) | Medium | GraphQL API / Issuable (Issue & WorkItem) types + REST work items entities + issuable sidebar serializer — exposure of the reply-by-email address (create_note_email) | [`bb025913`](https://gitlab.com/gitlab-org/gitlab/-/commit/bb02591386b158de0be00478f34c2e2cb3439f41) | | 2026-06-23 | [CVE-2026-11379](https://nvd.nist.gov/vuln/detail/CVE-2026-11379) | Medium | DAST (Dynamic Application Security Testing) on-demand scans — DAST site profile management (EE, dynamic_application_security_testing feature category) | [`27964951`](https://gitlab.com/gitlab-org/gitlab/-/commit/2796495131cfedfc985766d5fab3c1e00449e7e8) | | 2026-07-07 | [CVE-2026-6352](https://nvd.nist.gov/vuln/detail/CVE-2026-6352) | Low | GraphQL compliance-violation mutations (Compliance Management / Compliance Center) in GitLab EE | [`4e789b7c`](https://gitlab.com/gitlab-org/gitlab/-/commit/4e789b7cb478fd56856adb69dcb982767c1cfac0) | ### G10. GraphQL static cost model under-counts and misses rate limits *recurring, 12 findings* **Root cause.** GitLab bounds GraphQL cost with static complexity scoring, but Gitaly-backed blob/snippet fields are scored near-1 and not flagged calls_gitaly, array/iids arguments get a zero multiplier, expensive resolvers (blobSearch) skip the REST rate limiter, and introspection is resolved live, so crafted queries exceed the intended budget. **Prevent.** Every field that loads Gitaly/heavy data declares calls_gitaly and a non-trivial complexity; array args carry a length multiplier; CI test asserts cost floors. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2025-06-24 | [CVE-2025-3279](https://nvd.nist.gov/vuln/detail/CVE-2025-3279) | Medium | GraphQL API (app/graphql / GitlabSchema query validation + execution pipeline) | not publicly recorded | | 2025-08-26 | [CVE-2025-4225](https://nvd.nist.gov/vuln/detail/CVE-2025-4225) | Medium | GraphQL API — project snippet blob resolvers/types (query complexity analysis) | [`7f68fef7`](https://gitlab.com/gitlab-org/gitlab/-/commit/7f68fef736d27609d965793b08cedbf2f27b9e44) | | 2025-09-25 | [CVE-2025-10867](https://nvd.nist.gov/vuln/detail/CVE-2025-10867) | Low | GraphQL API - global/advanced code search (blobSearch resolver, Zoekt-backed) | [`a9834dc5`](https://gitlab.com/gitlab-org/gitlab/-/commit/a9834dc5bd0de4d102165e399c1795d8cc9539fe) | | 2025-09-25 | [CVE-2025-11042](https://nvd.nist.gov/vuln/detail/CVE-2025-11042) | Medium | EE GraphQL code search — Query.blobSearch resolver (Zoekt-backed blob/code search) | [`a9834dc5`](https://gitlab.com/gitlab-org/gitlab/-/commit/a9834dc5bd0de4d102165e399c1795d8cc9539fe) | | 2025-09-25 | [CVE-2025-8014](https://nvd.nist.gov/vuln/detail/CVE-2025-8014) | High | GraphQL API - query complexity accounting (Resolvers::BaseResolver) | [`e0f469c9`](https://gitlab.com/gitlab-org/gitlab/-/commit/e0f469c9fb95b0a1260f5912d87423a31969d68f) | | 2025-10-08 | [CVE-2025-10004](https://nvd.nist.gov/vuln/detail/CVE-2025-10004) | High | GraphQL API - repository blob fields (BlobsResolver / BlobType / BlobPresenter) | [`f57fdaa9`](https://gitlab.com/gitlab-org/gitlab/-/commit/f57fdaa9dd883959d6759f22c0dd50a13d5bb773) | | 2025-10-21 | [CVE-2025-11447](https://nvd.nist.gov/vuln/detail/CVE-2025-11447) | High | GraphQL API (variables parsing) / lib/gitlab/graphql | [`0b5604a7`](https://gitlab.com/gitlab-org/gitlab/-/commit/0b5604a74932d01fb9f7e421a57872825916ff07) | | 2025-12-10 | [CVE-2025-12562](https://nvd.nist.gov/vuln/detail/CVE-2025-12562) | High | GraphQL API — query complexity analysis (Resolvers::BaseResolver / BaseField connection complexity) | [`a6c726c5`](https://gitlab.com/gitlab-org/gitlab/-/commit/a6c726c54c2f549062d5948655bf4edb35862a6c) | | 2026-02-09 | [CVE-2025-8099](https://nvd.nist.gov/vuln/detail/CVE-2025-8099) | High | GraphQL API (GraphqlController introspection handling / GitlabSchema) | [`1b35f790`](https://gitlab.com/gitlab-org/gitlab/-/commit/1b35f7901d5605e055b9d429997ea90490189e36) | | 2026-03-10 | [CVE-2026-1069](https://nvd.nist.gov/vuln/detail/CVE-2026-1069) | High | GraphQL API request handling (GraphQL variables parsing) | [`1a592880`](https://gitlab.com/gitlab-org/gitlab/-/commit/1a5928809b5debd3929af99385f8487e4082deee) | | 2026-04-07 | [CVE-2025-12664](https://nvd.nist.gov/vuln/detail/CVE-2025-12664) | High | GraphQL API - argument coercion / input validation (app/graphql/types/base_argument.rb, base class for every GraphQL argument) | [`22cf8065`](https://gitlab.com/gitlab-org/gitlab/-/commit/22cf8065331ba4909c8572b88830f7224689e197) | | 2026-04-07 | [CVE-2026-1101](https://nvd.nist.gov/vuln/detail/CVE-2026-1101) | Medium | GraphQL API - shared argument coercion layer (app/graphql/types/base_argument.rb) | [`22cf8065`](https://gitlab.com/gitlab-org/gitlab/-/commit/22cf8065331ba4909c8572b88830f7224689e197) | ### G11. No max-length validation on user-writable model string fields *recurring, 12 findings* **Root cause.** Model attributes filled from user/integration input (webhook token/url, board/runner/release/approval-rule/trigger names, ChatName, cluster fields, diff position, header names) are validated only for presence/format with uncapped DB columns, so an arbitrarily large value is persisted and re-processed. **Prevent.** A model-audit test/rubocop requires a length validation on every user-assignable string column; migrations add length caps. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2024-05-21 | [CVE-2024-2874](https://nvd.nist.gov/vuln/detail/CVE-2024-2874) | Medium | CI runners (Ci::Runner registration/update API + model persistence) | [`688ca12a`](https://gitlab.com/gitlab-org/gitlab/-/commit/688ca12a6d37329f70f3862f5cb4a7ac75c4fafa) | | 2025-03-11 | [CVE-2025-1257](https://nvd.nist.gov/vuln/detail/CVE-2025-1257) | Medium | EE Merge Request / Project / Group approval rules (approvals) — REST API + ActiveRecord model layer | [`57a03b55`](https://gitlab.com/gitlab-org/gitlab/-/commit/57a03b551b4c1442a17368b0a99a6173fcec387e) | | 2025-04-09 | [CVE-2025-1677](https://nvd.nist.gov/vuln/detail/CVE-2025-1677) | Medium | ci-pipelines / project-import-export | [`8606ad7c`](https://gitlab.com/gitlab-org/gitlab/-/commit/8606ad7c7593b54fab2a1844d611db358e2f3187) | | 2025-05-21 | [CVE-2025-2853](https://nvd.nist.gov/vuln/detail/CVE-2025-2853) | Medium | Merge request diff notes / code review (Notes & DraftNote position fields) | [`353f7258`](https://gitlab.com/gitlab-org/gitlab/-/commit/353f72582ead37c8569ad5a56769236716536cf5) | | 2025-05-21 | [CVE-2025-3111](https://nvd.nist.gov/vuln/detail/CVE-2025-3111) | Medium | Kubernetes cluster integration (Clusters::Cluster / Clusters::Platforms::Kubernetes models) | [`414468af`](https://gitlab.com/gitlab-org/gitlab/-/commit/414468af6fd95eef1a2d9ec0161ddd361f6c4619) | | 2025-06-11 | [CVE-2025-1478](https://nvd.nist.gov/vuln/detail/CVE-2025-1478) | Medium | Issue Boards (app/models/board.rb) — board name validation | [`b5067ab3`](https://gitlab.com/gitlab-org/gitlab/-/commit/b5067ab36cdc5b52c288f670d38183328254b9b4) | | 2025-06-11 | [CVE-2025-1516](https://nvd.nist.gov/vuln/detail/CVE-2025-1516) | Medium | Webhooks (WebHooks::Hook model concern shared by ProjectHook / GroupHook / SystemHook / ServiceHook) | [`05d67310`](https://gitlab.com/gitlab-org/gitlab/-/commit/05d673100709748da289fabb787aa89465029e09) | | 2025-08-12 | [CVE-2025-1477](https://nvd.nist.gov/vuln/detail/CVE-2025-1477) | Medium | Integrations / ChatOps slash commands (Mattermost & Slack) — ChatName model | [`160a2093`](https://gitlab.com/gitlab-org/gitlab/-/commit/160a209332f48df7aa28f0521d90470f1d2a6b22) | | 2025-08-12 | [CVE-2025-2614](https://nvd.nist.gov/vuln/detail/CVE-2025-2614) | Medium | Releases (app/models/release.rb + Releases REST API) | [`ad076067`](https://gitlab.com/gitlab-org/gitlab/-/commit/ad0760676fe8c18de286d609e9699a7245ed912f) | | 2025-09-09 | [CVE-2025-10094](https://nvd.nist.gov/vuln/detail/CVE-2025-10094) | Medium | Deploy tokens (project/group settings) — DeployToken model input validation | [`f55739ad`](https://gitlab.com/gitlab-org/gitlab/-/commit/f55739ada891e50e67f7bc59a7626f3f2e8b642e) | | 2026-02-24 | [CVE-2025-3525](https://nvd.nist.gov/vuln/detail/CVE-2025-3525) | Medium | CI/CD pipeline trigger tokens (Ci::Trigger model + /projects/:id/triggers API) | [`2148e8a9`](https://gitlab.com/gitlab-org/gitlab/-/commit/2148e8a95fc1cd6de7010b7457e476fdfdc54a57) | | 2026-03-10 | [CVE-2025-13690](https://nvd.nist.gov/vuln/detail/CVE-2025-13690) | Medium | webhooks (custom headers) | [`ea179c0e`](https://gitlab.com/gitlab-org/gitlab/-/commit/ea179c0e7694e75d8882cd0b99ff70fd1c08a4c5) | ### G12. Expensive endpoints lack pagination/cache/throttle or unbounded fan-out *recurring, 11 findings* **Root cause.** Endpoints perform work proportional to attacker-chosen size with no ceiling: unpaginated/optional-per_page listings (notes/discussions/branches), per-request re-aggregation with no cache (test reports, expanded diffs), unbounded date spans, one background job per matched item, or full archive generation on a cheap HEAD. **Prevent.** Listing endpoints enforce a hard max_per_page and never skip pagination; expensive aggregations are cached/throttled; fan-out is capped. Integration tests. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2024-02-07 | [CVE-2024-1066](https://nvd.nist.gov/vuln/detail/CVE-2024-1066) | Medium | GraphQL Vulnerability Security Dashboard (ee) - VulnerabilitiesCountPerDayResolver | [`18d19704`](https://gitlab.com/gitlab-org/gitlab/-/commit/18d19704b5446b8af7510b49dd94c9b733b956de) | | 2024-05-07 | [CVE-2024-4539](https://nvd.nist.gov/vuln/detail/CVE-2024-4539) | Medium | Repository branches/tags REST API (BranchesFinder / TagsFinder pagination) | [`1c2d72df`](https://gitlab.com/gitlab-org/gitlab/-/commit/1c2d72dfb7b4a237c43725857b79144aac30156d) | | 2024-05-21 | [CVE-2024-1947](https://nvd.nist.gov/vuln/detail/CVE-2024-1947) | Medium | CI/CD pipelines REST API (Grape) — pipeline test report endpoint | [`3acb41e9`](https://gitlab.com/gitlab-org/gitlab/-/commit/3acb41e920fe8650fe7d9dbbddf1e61ab7563584) | | 2024-10-09 | [CVE-2024-9631](https://nvd.nist.gov/vuln/detail/CVE-2024-9631) | High | Merge Requests / diff conflict listing (Projects::MergeRequests::DiffsController -> DiffHelper#conflicts_with_types -> MergeRequests::Conflicts::ListService -> Gitlab::Conflict::FileCollection -> Gitlab::Git::Conflict::Resolver -> GitalyClient::ConflictsService) | [`00b8a6c8`](https://gitlab.com/gitlab-org/gitlab/-/commit/00b8a6c8f527) | | 2024-11-26 | [CVE-2024-11828](https://nvd.nist.gov/vuln/detail/CVE-2024-11828) | Medium | CI/CD pipeline test-report artifacts (Ci::JobArtifact / Ci::Build report collection, junit test reports) | [`88b5c418`](https://gitlab.com/gitlab-org/gitlab/-/commit/88b5c418116227a84bec2ec0b9b797d449d83096) | | 2024-12-10 | [CVE-2024-8233](https://nvd.nist.gov/vuln/detail/CVE-2024-8233) | High | source_code_management / commit diff rendering (Projects::CommitController#diff_files) | [`5581b0d0`](https://gitlab.com/gitlab-org/gitlab/-/commit/5581b0d0d1e95309d72ecca3b59650f28a29077c) | | 2025-09-09 | [CVE-2025-1250](https://nvd.nist.gov/vuln/detail/CVE-2025-1250) | Medium | merge_requests / closing-issue extraction (Sidekiq background jobs) | [`2a34fb6d`](https://gitlab.com/gitlab-org/gitlab/-/commit/2a34fb6dd183) | | 2026-03-10 | [CVE-2025-13929](https://nvd.nist.gov/vuln/detail/CVE-2025-13929) | High | Repository archive endpoints (web controller + REST API + Composer package registry) -> Workhorse/Gitaly git-archive generation | [`425f620d`](https://gitlab.com/gitlab-org/gitlab/-/commit/425f620dbdb89a6e5fda77f67e4d4bf71ea7f276) | | 2026-04-21 | [CVE-2025-0186](https://nvd.nist.gov/vuln/detail/CVE-2025-0186) | Medium | Issues/Merge Requests - issuable discussions listing (notes) endpoint | [`ca41813c`](https://gitlab.com/gitlab-org/gitlab/-/commit/ca41813cb5a49eafec6f5ce047e31591be546242) | | 2026-04-21 | [CVE-2025-3922](https://nvd.nist.gov/vuln/detail/CVE-2025-3922) | Medium | GraphQL API / Notes & Discussions (Issuable::DiscussionsListService) | [`48e88d29`](https://gitlab.com/gitlab-org/gitlab/-/commit/48e88d2976db4c3d5348078fdb697958220dfcae) | | 2026-04-21 | [CVE-2025-6016](https://nvd.nist.gov/vuln/detail/CVE-2025-6016) | Medium | Notes - notes polling endpoint (NotesActions concern / gather_all_notes) | [`0558ebc5`](https://gitlab.com/gitlab-org/gitlab/-/commit/0558ebc55d7980d1a72aa1218ed700c443b070ab) | ### G13. Feature-disabled revocation is a hand-maintained denylist that omits abilities *recurring, 10 findings* **Root cause.** Per-project/group feature toggles (repository, builds, security_and_compliance, package registry) are enforced by a single deny-rule that must explicitly prevent every ability the disabled feature should hide, but new granular abilities are added by role rules without being added to the denylist, and finder scopes conflate membership with feature access. **Prevent.** Every ability tagged to a feature is automatically prevented when the feature is disabled; a test enumerates feature abilities and asserts revocation. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2024-06-25 | [CVE-2024-6323](https://nvd.nist.gov/vuln/detail/CVE-2024-6323) | High | Global code search (Zoekt) / EE search services | [`d38ed3d4`](https://gitlab.com/gitlab-org/gitlab/-/commit/d38ed3d433f51060c7c7daa793ce9aaf14beb513) | | 2025-02-11 | [CVE-2025-1042](https://nvd.nist.gov/vuln/detail/CVE-2025-1042) | Medium | authorization / project access policy (EE custom roles, repository feature access) | [`047963e5`](https://gitlab.com/gitlab-org/gitlab/-/commit/047963e52d1905b2c053c02e014f09c4150a7682) | | 2025-07-22 | [CVE-2025-7001](https://nvd.nist.gov/vuln/detail/CVE-2025-7001) | Medium | Authorization / ProjectPolicy (CI resource groups API) | [`2abd91fa`](https://gitlab.com/gitlab-org/gitlab/-/commit/2abd91fa59379f838658cdb625d9596a803331ca) | | 2025-11-25 | [CVE-2025-6195](https://nvd.nist.gov/vuln/detail/CVE-2025-6195) | Medium | Banzai markdown reference parsing / redaction (EE vulnerability references) | [`ef4f565f`](https://gitlab.com/gitlab-org/gitlab/-/commit/ef4f565f1596cdb700de9113114f16d5f20f481f) | | 2026-03-10 | [CVE-2025-12555](https://nvd.nist.gov/vuln/detail/CVE-2025-12555) | Medium | CI/CD runners API - runner jobs listing / project authorization scope (User#authorized_project_mirrors) | [`cd7e2e85`](https://gitlab.com/gitlab-org/gitlab/-/commit/cd7e2e85618291305abc1a953d200ac9a28dc38c) | | 2026-04-07 | [CVE-2026-1752](https://nvd.nist.gov/vuln/detail/CVE-2026-1752) | Medium | CI/CD Environments API (protected environments authorization) | [`a21ce354`](https://gitlab.com/gitlab-org/gitlab/-/commit/a21ce35464c0) | | 2026-06-10 | [CVE-2026-6269](https://nvd.nist.gov/vuln/detail/CVE-2026-6269) | Medium | Authorization policies for issuables (MergeRequestPolicy / IssuePolicy) — access control for merge requests and issues authored by banned ("hidden") users | [`aaf83a5c`](https://gitlab.com/gitlab-org/gitlab/-/commit/aaf83a5cfccb4dd569aacc7877cfa0d9e53daa81) | | 2026-06-10 | [CVE-2026-6277](https://nvd.nist.gov/vuln/detail/CVE-2026-6277) | Medium | Authorization / DeclarativePolicy - ProjectPolicy (project 'Security and Compliance' feature toggle enforcement) | [`ef67ffa6`](https://gitlab.com/gitlab-org/gitlab/-/commit/ef67ffa6e6e307ab2e866a52c747405b15f13126) | | 2026-06-23 | [CVE-2026-0934](https://nvd.nist.gov/vuln/detail/CVE-2026-0934) | Low | Authorization / ProjectPolicy — Protected Environments API (CI/CD) | [`32af8c31`](https://gitlab.com/gitlab-org/gitlab/-/commit/32af8c31894171813b7f82cdbaa4804f82b27219) | | 2026-06-23 | [CVE-2026-5796](https://nvd.nist.gov/vuln/detail/CVE-2026-5796) | Medium | Package Registry — group-level packages listing (REST API `lib/api/group_packages.rb` and GraphQL `GroupPackagesResolver`) | [`2d9311df`](https://gitlab.com/gitlab-org/gitlab/-/commit/2d9311df85f565fa1653810cffeaecdb8139b172) | ### G14. A new/limited role is silently included in an ability grant not meant for it *recurring, 10 findings* **Root cause.** Abilities granted by role rules (destroy_issue, incident admin, code-review analytics, work-item links, security attributes, read_pages_content, virtual-registry/subgroup read) implicitly widen to a newer or lower role (Planner, Reporter, Guest, implicit guest_access, MINIMAL_ACCESS members) because the rule was written before the role existed or reused a broad predicate. **Prevent.** Introducing/adjusting a role requires a policy-diff review listing every ability it newly satisfies; snapshot tests over role-to-ability matrices. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2024-09-11 | [CVE-2024-6685](https://nvd.nist.gov/vuln/detail/CVE-2024-6685) | Low | CI Runners authorization (Ci::RunnerPolicy) — group runner read access | [`924c311d`](https://gitlab.com/gitlab-org/gitlab/-/commit/924c311d3f9727e118b60b7a1973ab60009d0efa) | | 2025-02-11 | [CVE-2025-0516](https://nvd.nist.gov/vuln/detail/CVE-2025-0516) | Medium | Authorization policies for issues / work items (Incident issue-type) — app/policies (IssuePolicy, WorkItemPolicy), issuable sidebar serializer, incident LinkAlerts service | [`96c29d4c`](https://gitlab.com/gitlab-org/gitlab/-/commit/96c29d4cea022495546617429116226c65b6c779) | | 2025-02-26 | [CVE-2024-10925](https://nvd.nist.gov/vuln/detail/CVE-2024-10925) | Medium | Security Orchestration Policies (Security Policy Project) authorization — EE declarative_policy | [`8006df30`](https://gitlab.com/gitlab-org/gitlab/-/commit/8006df30b166) | | 2025-02-26 | [CVE-2025-2045](https://nvd.nist.gov/vuln/detail/CVE-2025-2045) | Medium | EE ProjectPolicy authorization for Code Review Analytics (value stream management) | [`3e82c62c`](https://gitlab.com/gitlab-org/gitlab/-/commit/3e82c62c208678269aee11038662e8b4cbf70c54) | | 2025-06-24 | [CVE-2025-5315](https://nvd.nist.gov/vuln/detail/CVE-2025-5315) | Medium | Work items / incident management authorization (WorkItemPolicy + ParentLinks hierarchy service) | [`eab51ce5`](https://gitlab.com/gitlab-org/gitlab/-/commit/eab51ce5967c0bbf102d71331c8eb8f0d7df80e0) | | 2025-08-12 | [CVE-2024-12303](https://nvd.nist.gov/vuln/detail/CVE-2024-12303) | Medium | Authorization / role-based access control (declarative policies: GroupPolicy, ProjectPolicy) governing the Planner role's ability to delete issues | [`7cef19c9`](https://gitlab.com/gitlab-org/gitlab/-/commit/7cef19c9fc5d3140c63721f63e42683868dd6f43) | | 2025-11-11 | [CVE-2025-7736](https://nvd.nist.gov/vuln/detail/CVE-2025-7736) | Low | GitLab Pages access control / ProjectPolicy authorization (read_pages_content ability) | [`af0f99c9`](https://gitlab.com/gitlab-org/gitlab/-/commit/af0f99c9f71f16648a4cdcbb2fac78697efc20a8) | | 2026-03-10 | [CVE-2025-12704](https://nvd.nist.gov/vuln/detail/CVE-2025-12704) | Low | Virtual Registry (Packages) group authorization policy — EE | [`b5792dec`](https://gitlab.com/gitlab-org/gitlab/-/commit/b5792dec11fb6572c67afea694ae79124b6c443f) | | 2026-03-24 | [CVE-2025-14595](https://nvd.nist.gov/vuln/detail/CVE-2025-14595) | Medium | GitLab EE group security configuration — Security Categories & Attributes (GraphQL), governed by the GroupPolicy / custom-ability authorization layer | [`ef59c8c4`](https://gitlab.com/gitlab-org/gitlab/-/commit/ef59c8c478db98fc7157a5b6f6e48742ad1e9716) | | 2026-07-07 | [CVE-2026-8472](https://nvd.nist.gov/vuln/detail/CVE-2026-8472) | Medium | Work items / Issues finder (group-scoped listing with include_subgroups) - GitLab EE | [`e12f424f`](https://gitlab.com/gitlab-org/gitlab/-/commit/e12f424f9d08) | ### G15. Markup rendering pipeline has no per-document work/time budget *recurring, 10 findings* **Root cause.** The Banzai/AsciiDoc/markup rendering pipeline runs an open-ended chain of superlinear filters (emoji/autolink/task-list/relative-link, comrak, TOML/AsciiDoc parse) over attacker markdown with per-filter opt-in timeouts and no cumulative node-count or wall-clock budget, so crafted documents exhaust CPU. **Prevent.** Every markup render is wrapped by one budget guard (nodes + time); ApplicationSetting content caps are tight by default; benchmark tests. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2024-03-27 | [CVE-2024-2818](https://nvd.nist.gov/vuln/detail/CVE-2024-2818) | Medium | Banzai markdown rendering pipeline (Banzai::Filter::EmojiFilter) as reached via Label descriptions | [`8d949c60`](https://gitlab.com/gitlab-org/gitlab/-/commit/8d949c60d508b6cf3d558fc4f906c82b03e06748) | | 2024-06-25 | [CVE-2024-4557](https://nvd.nist.gov/vuln/detail/CVE-2024-4557) | Medium | Banzai Markdown rendering pipeline (lib/banzai/*) | [`7a7560eb`](https://gitlab.com/gitlab-org/gitlab/-/commit/7a7560ebf98b9e3fed749c0895c7fe952a35d0e6) | | 2024-08-06 | [CVE-2024-4210](https://nvd.nist.gov/vuln/detail/CVE-2024-4210) | Medium | AsciiDoc markup rendering (lib/gitlab/asciidoc.rb + IncludeProcessor) | [`73f3ea94`](https://gitlab.com/gitlab-org/gitlab/-/commit/73f3ea94b844fbc3dfe4e6a4ef9edf3375e67360) | | 2024-08-06 | [CVE-2024-5423](https://nvd.nist.gov/vuln/detail/CVE-2024-5423) | Medium | Banzai markdown/reference rendering pipeline (lib/banzai/filter) | [`9a5b8ae2`](https://gitlab.com/gitlab-org/gitlab/-/commit/9a5b8ae2305b905f4ff6d92041294273b1dda4d4) | | 2024-11-26 | [CVE-2024-8237](https://nvd.nist.gov/vuln/detail/CVE-2024-8237) | Medium | Blob view / dependency linker (source code management) — Gitlab::DependencyLinker::CargoTomlLinker TOML parsing | [`394176de`](https://gitlab.com/gitlab-org/gitlab/-/commit/394176de261c7f5cc32cc5b6cb75871e65211e43) | | 2025-04-22 | [CVE-2025-0639](https://nvd.nist.gov/vuln/detail/CVE-2025-0639) | Medium | Markdown rendering pipeline (Banzai) — quick-action detection & link sanitization filters, reached via issue/markdown preview | [`78466ef2`](https://gitlab.com/gitlab-org/gitlab/-/commit/78466ef2cd3d) | | 2025-08-12 | [CVE-2025-2937](https://nvd.nist.gov/vuln/detail/CVE-2025-2937) | Medium | Wiki / Markdown rendering (Banzai) — ApplicationSetting default limit | [`22459d1d`](https://gitlab.com/gitlab-org/gitlab/-/commit/22459d1d6b7e7adabe1867bcbcf681099c1d392e) | | 2025-11-11 | [CVE-2025-12983](https://nvd.nist.gov/vuln/detail/CVE-2025-12983) | Low | Banzai markdown rendering pipeline / gitlab-glfm-markdown (Rust comrak CommonMark parser) | [`362b9b66`](https://gitlab.com/gitlab-org/gitlab/-/commit/362b9b665401e4f2bbeb1713c5b9eb41c96cc925) | | 2026-02-09 | [CVE-2026-1456](https://nvd.nist.gov/vuln/detail/CVE-2026-1456) | Medium | Banzai markdown rendering pipeline (GitLab Flavored Markdown) - TaskListFilter | [`40588a15`](https://gitlab.com/gitlab-org/gitlab/-/commit/40588a156c6b61db85e8ad62eac623e843a5d1c2) | | 2026-02-09 | [CVE-2026-1458](https://nvd.nist.gov/vuln/detail/CVE-2026-1458) | Medium | Banzai markdown rendering pipeline — RepositoryLinkFilter (relative repository link rewriting) | [`e8682f27`](https://gitlab.com/gitlab-org/gitlab/-/commit/e8682f27360d12531d5276b1258495ac9678b007) | ### G16. EE custom roles let a coarse ability guard a privileged op with no ceiling *recurring, 9 findings* **Root cause.** EE custom roles can grant a coarse ability (admin_group_member, admin_runners, view_edit_page, admin_member_role) to a non-owner, and operations (token creation/rotation, member ban/activate, member/role assignment, runner writes) check only that coarse ability with the privilege-ceiling enforcement implemented only on the group path or as no-op stubs, so a lower-privileged custom role escalates. **Prevent.** The base creation/rotation/assignment services enforce the actor-encompasses-target ceiling unconditionally; a test asserts no non-owner custom role can exceed its own level. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2024-02-07 | [CVE-2024-1250](https://nvd.nist.gov/vuln/detail/CVE-2024-1250) | Medium | resource-access-tokens / group access token creation (custom roles / member roles) | [`c50f4096`](https://gitlab.com/gitlab-org/gitlab/-/commit/c50f40966c4a) | | 2024-03-06 | [CVE-2024-1299](https://nvd.nist.gov/vuln/detail/CVE-2024-1299) | Medium | system_access / resource access tokens API (group access token rotation) | [`18abfbc0`](https://gitlab.com/gitlab-org/gitlab/-/commit/18abfbc075083ec0921d47056c185f01478eaf0c) | | 2024-07-09 | [CVE-2024-2880](https://nvd.nist.gov/vuln/detail/CVE-2024-2880) | Low | Group members management / custom-role authorization (EE Groups::GroupMembersController#ban) | [`81594e06`](https://gitlab.com/gitlab-org/gitlab/-/commit/81594e06ccef46c19dbb2b9e760d3422a9bdf4eb) | | 2024-09-11 | [CVE-2024-8631](https://nvd.nist.gov/vuln/detail/CVE-2024-8631) | Medium | Authorization / EE group policy for custom roles (member roles) | [`9c6ad85f`](https://gitlab.com/gitlab-org/gitlab/-/commit/9c6ad85f4a22c95d86352da8e15e6bd85de33bf2) | | 2025-03-11 | [CVE-2024-7296](https://nvd.nist.gov/vuln/detail/CVE-2024-7296) | Low | Group members / membership approval (activation of awaiting members past the user cap) — EE custom roles authorization | [`6ee484f5`](https://gitlab.com/gitlab-org/gitlab/-/commit/6ee484f51bf9ca4b554fd996e808d9c0a1082e61) | | 2025-09-25 | [CVE-2025-10871](https://nvd.nist.gov/vuln/detail/CVE-2025-10871) | Low | Members / custom roles authorization (Members::CreatorService + EE Member models) | [`afb3d9e6`](https://gitlab.com/gitlab-org/gitlab/-/commit/afb3d9e6f0ff2e021ee0a31412e764e81c90c8f2) | | 2025-09-25 | [CVE-2025-7691](https://nvd.nist.gov/vuln/detail/CVE-2025-7691) | Medium | Members / role assignment (app/services/members + ee/app/models/ee/member.rb) — project membership & custom roles | [`afb3d9e6`](https://gitlab.com/gitlab-org/gitlab/-/commit/afb3d9e6f0ff2e021ee0a31412e764e81c90c8f2) | | 2025-10-21 | [CVE-2025-11702](https://nvd.nist.gov/vuln/detail/CVE-2025-11702) | High | CI/CD Runners authorization (EE custom roles) — Ci::RunnerPolicy | [`4c985e24`](https://gitlab.com/gitlab-org/gitlab/-/commit/4c985e24e4fbf1fe26030d5e30955e20ae1ce83c) | | 2026-04-07 | [CVE-2026-4916](https://nvd.nist.gov/vuln/detail/CVE-2026-4916) | Low | Member / role management authorization (Members::UpdateService, Members::CreatorService, Member model) | [`9c03a0c1`](https://gitlab.com/gitlab-org/gitlab/-/commit/9c03a0c126b84042b0626afb73af3f3725d44957) | ### G17. Object dereferenced by bare global id, outside the authorized scope *recurring, 9 findings* **Root cause.** Endpoints authorize the user against a URL/parent scope (group/project) but then load the target object (framework, cleanup policy, namespace, label, MR, symbol, runner-project, installation) by a bare global primary key / attacker-supplied id with a non-authorizing finder or inconsistent id coercion, so the authorized and retrieved objects diverge. **Prevent.** Object lookups are scoped to the authorized parent (association-scoped finder); a lint/test flags find_by(global_id) after a scope authorization. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2025-06-11 | [CVE-2025-5121](https://nvd.nist.gov/vuln/detail/CVE-2025-5121) | High | Compliance Management - compliance framework project assignment (EE) | [`197955ca`](https://gitlab.com/gitlab-org/gitlab/-/commit/197955ca0fe6) | | 2025-06-11 | [CVE-2025-5195](https://nvd.nist.gov/vuln/detail/CVE-2025-5195) | Medium | ee/compliance_management - Group compliance dashboard framework JSON export controller | [`126fe92e`](https://gitlab.com/gitlab-org/gitlab/-/commit/126fe92ee74856bda0c83ff425b45eba7d22ae93) | | 2025-06-24 | [CVE-2025-5846](https://nvd.nist.gov/vuln/detail/CVE-2025-5846) | Low | Compliance Management - compliance framework project assignment (GraphQL) | [`77b0f0e0`](https://gitlab.com/gitlab-org/gitlab/-/commit/77b0f0e08877c9190093f02122619251a3d99648) | | 2026-01-07 | [CVE-2025-11246](https://nvd.nist.gov/vuln/detail/CVE-2025-11246) | Medium | CI/CD Runners — GraphQL runner update mutation and the SetRunnerAssociatedProjects service (Ci::RunnerProject join table) | [`dd5bd475`](https://gitlab.com/gitlab-org/gitlab/-/commit/dd5bd47592677f759916743a3500b051296acdea) | | 2026-01-07 | [CVE-2025-13772](https://nvd.nist.gov/vuln/detail/CVE-2025-13772) | High | EE API - Duo Agent Platform / Duo Workflows (AI), endpoint GET /api/v4/ai/duo_workflows/ws (ee/lib/api/ai/duo_workflows/workflows.rb) | [`a73f6179`](https://gitlab.com/gitlab-org/gitlab/-/commit/a73f617930b5c507316d6f6d1ef8f33eea057041) | | 2026-03-10 | [CVE-2026-1663](https://nvd.nist.gov/vuln/detail/CVE-2026-1663) | Medium | Import/Export (group import) — Gitlab::ImportExport object builders / relation factory | [`4a9113df`](https://gitlab.com/gitlab-org/gitlab/-/commit/4a9113dfacf4) | | 2026-03-24 | [CVE-2026-2370](https://nvd.nist.gov/vuln/detail/CVE-2026-2370) | High | Jira Connect (Atlassian Connect app) installations controller / lifecycle-event proxy | [`cc9b0b89`](https://gitlab.com/gitlab-org/gitlab/-/commit/cc9b0b89e225e5d35cf306744420fafd3df6446a) | | 2026-03-24 | [CVE-2026-2726](https://nvd.nist.gov/vuln/detail/CVE-2026-2726) | Medium | Merge requests / git push options handling (PostReceive) | [`8a19ae43`](https://gitlab.com/gitlab-org/gitlab/-/commit/8a19ae43d1e2d5ce262b344cbedb27d208457355) | | 2026-06-23 | [CVE-2026-5309](https://nvd.nist.gov/vuln/detail/CVE-2026-5309) | Medium | Virtual Registry (Maven/container package virtual registry) cleanup policy REST API, GitLab EE | [`45be021a`](https://gitlab.com/gitlab-org/gitlab/-/commit/45be021a3001f94ce5ac2bd1ac514f66e9088690) | ### G18. Repository blob/config eagerly loaded into memory with no size cap *recurring, 9 findings* **Root cause.** Endpoints and renderers load an entire repository-stored file into worker memory (load_all_data! / blob_data_at bypassing the display cap, base64 inline, Diffy, YAML dashboard/insights/wiki configs, XML manifest, EXIF) with no size gate, and configs are re-parsed per request with no caching. **Prevent.** No code path loads a full blob without a max-size check; repo-config parses are size-gated and cached; test per loader. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2024-10-22 | [CVE-2024-6826](https://nvd.nist.gov/vuln/detail/CVE-2024-6826) | Medium | Project import - Manifest (repo/AOSP) importer | [`505c055c`](https://gitlab.com/gitlab-org/gitlab/-/commit/505c055c8c22a93b32dfc0c0738fd93f81b38335) | | 2025-03-11 | [CVE-2024-13054](https://nvd.nist.gov/vuln/detail/CVE-2024-13054) | Medium | source_code_management (blob edit/preview) - Projects::BlobController | [`10b827df`](https://gitlab.com/gitlab-org/gitlab/-/commit/10b827df7c47db18d805f361d82d78f570eb0898) | | 2025-05-21 | [CVE-2025-0993](https://nvd.nist.gov/vuln/detail/CVE-2025-0993) | High | REST API - repository blob/file endpoints (Grape API::Repositories, API::Files) | [`dadbfc18`](https://gitlab.com/gitlab-org/gitlab/-/commit/dadbfc188a26f1a11c83812875595415c24b90c1) | | 2025-09-09 | [CVE-2025-7337](https://nvd.nist.gov/vuln/detail/CVE-2025-7337) | Medium | source_code_management (repository blob browser-edit path) | [`206c80e6`](https://gitlab.com/gitlab-org/gitlab/-/commit/206c80e60f6b2e2326fb1edba9799a0b3a29becc) | | 2025-12-10 | [CVE-2025-4097](https://nvd.nist.gov/vuln/detail/CVE-2025-4097) | Medium | workhorse image upload / EXIF metadata sanitization (also lib/gitlab/sanitizers/exif.rb) | [`c2125e37`](https://gitlab.com/gitlab-org/gitlab/-/commit/c2125e3702425f3c77e6ad6242489c04768eb71b) | | 2026-02-09 | [CVE-2026-1387](https://nvd.nist.gov/vuln/detail/CVE-2026-1387) | Medium | Analytics :: Customizable (Product Analytics) Dashboards (EE) — YAML dashboard config loading | [`43ef889c`](https://gitlab.com/gitlab-org/gitlab/-/commit/43ef889c2b8f20d2d241899a2fdf053a5babaa22) | | 2026-03-24 | [CVE-2025-13436](https://nvd.nist.gov/vuln/detail/CVE-2025-13436) | Medium | CI/CD YAML config loader (Gitlab::Config::Loader::Yaml), reached via CI Lint / pipeline config parsing | [`168d025c`](https://gitlab.com/gitlab-org/gitlab/-/commit/168d025cd585bf2514cbe0be43e8b9923bd9ffbc) | | 2026-05-13 | [CVE-2026-1184](https://nvd.nist.gov/vuln/detail/CVE-2026-1184) | Medium | GitLab EE Insights (Value Stream Management) — project/group Insights configuration loading (.gitlab/insights.yml) | [`fafb1cb9`](https://gitlab.com/gitlab-org/gitlab/-/commit/fafb1cb9d28286ca469268fce5b4062117d0ebba) | | 2026-05-26 | [CVE-2026-1402](https://nvd.nist.gov/vuln/detail/CVE-2026-1402) | Medium | Project/Group Wiki page redirections (WikiActions controller concern + Wiki model) | [`4688b36d`](https://gitlab.com/gitlab-org/gitlab/-/commit/4688b36ddc40212aa862ce3c53f00d8cb7e5db2e) | ### G19. ActionCable/GraphQL-subscription authorization is partial and fail-open *recurring, 8 findings* **Root cause.** WebSocket/ActionCable and GraphQL-subscription paths split authorization across incomplete gates: scope validator not constructed (fail-open), IP thread-local not populated (fail-open), no periodic re-auth of long-lived connections, :access_api not checked, class-level Grape scope accumulation, and every public method auto-exposed as an action. **Prevent.** ActionCable/subscription auth must construct the scope validator, populate IP, check :access_api, and re-validate periodically; fail-closed by default; tests per gate. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2024-04-24 | [CVE-2024-4006](https://nvd.nist.gov/vuln/detail/CVE-2024-4006) | Medium | GraphQL authorization / ActionCable subscriptions (personal access token scope enforcement) | [`0dccf32b`](https://gitlab.com/gitlab-org/gitlab/-/commit/0dccf32b71614584e05a8590b21a902220e8c701) | | 2024-11-26 | [CVE-2024-11668](https://nvd.nist.gov/vuln/detail/CVE-2024-11668) | Medium | ActionCable / WebSocket channel authentication (GraphQL & Noteable notes subscriptions) | [`52a0a4e4`](https://gitlab.com/gitlab-org/gitlab/-/commit/52a0a4e49bc9655ee4c84ec89615bbab8fd56810) | | 2024-11-26 | [CVE-2024-11669](https://nvd.nist.gov/vuln/detail/CVE-2024-11669) | Medium | Grape REST API token-scope authorization (lib/api APIGuard / usage_data endpoints) | [`4ab578aa`](https://gitlab.com/gitlab-org/gitlab/-/commit/4ab578aa290b27427661908105019643a4eb0e9a) | | 2024-11-26 | [CVE-2024-8114](https://nvd.nist.gov/vuln/detail/CVE-2024-8114) | High | REST API authorization / token scopes (Grape API + APIGuard) under lib/api, specifically the /api/v4/usage_data endpoints | [`4ab578aa`](https://gitlab.com/gitlab-org/gitlab/-/commit/4ab578aa290b27427661908105019643a4eb0e9a) | | 2025-02-11 | [CVE-2025-1198](https://nvd.nist.gov/vuln/detail/CVE-2025-1198) | Medium | ActionCable / real-time WebSocket channels (app/channels/application_cable) + PAT/OAuth token authentication (lib/gitlab/auth/auth_finders.rb) | [`74adac8e`](https://gitlab.com/gitlab-org/gitlab/-/commit/74adac8edd65cd3cb830e1674f540ee2566d749c) | | 2025-04-09 | [CVE-2025-2408](https://nvd.nist.gov/vuln/detail/CVE-2025-2408) | Medium | EE group IP access restrictions enforcement over the Action Cable (WebSocket / GraphQL subscriptions) transport | [`4dfcaa61`](https://gitlab.com/gitlab-org/gitlab/-/commit/4dfcaa61c92e172341175df32a2f5c844d8f0d81) | | 2025-11-11 | [CVE-2025-2615](https://nvd.nist.gov/vuln/detail/CVE-2025-2615) | Medium | ActionCable / GraphQL subscriptions (app/channels) | [`04086477`](https://gitlab.com/gitlab-org/gitlab/-/commit/04086477df0cde256e4d8ad5f05b634f0c20f1d1) | | 2026-04-07 | [CVE-2026-5173](https://nvd.nist.gov/vuln/detail/CVE-2026-5173) | High | ActionCable WebSocket channels (app/channels/application_cable) | [`366d0fa5`](https://gitlab.com/gitlab-org/gitlab/-/commit/366d0fa555370ef7f0291bb485142e3e05731568) | ### G20. Banzai HTML sanitizer does not enforce the invariants downstream filters assume *recurring, 8 findings* **Root cause.** The server-side Banzai HTML sanitization pipeline leaves parser-produced constructs (XML-namespaced SVG/MathML attributes, nested anchors, non-re-serialized DOM, entity round-trips, placeholder substitution into attribute context) that later link-safety/reference filters identify by local name and therefore miss. **Prevent.** Invariant test: after BaseSanitizationFilter the DOM contains no namespaced attributes, no nested anchors, and is browser-parse-stable; regression fixtures per construct. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2024-12-10 | [CVE-2024-10043](https://nvd.nist.gov/vuln/detail/CVE-2024-10043) | Low | content_editor (rich text editor) / GFM reference rendering (wikis) | [`4fa9c104`](https://gitlab.com/gitlab-org/gitlab/-/commit/4fa9c1041a27ad7b795b0c1c551ebba6dead4542) | | 2025-08-12 | [CVE-2025-7739](https://nvd.nist.gov/vuln/detail/CVE-2025-7739) | High | labels (scoped label descriptions) — issuable label rendering | not publicly recorded | | 2025-12-10 | [CVE-2025-12716](https://nvd.nist.gov/vuln/detail/CVE-2025-12716) | High | Banzai Markdown reference filters (AbstractReferenceFilter) — wiki page reference rendering | [`24e1797b`](https://gitlab.com/gitlab-org/gitlab/-/commit/24e1797bbcc461981a69329451c208fd6f703b91) | | 2026-01-07 | [CVE-2025-9222](https://nvd.nist.gov/vuln/detail/CVE-2025-9222) | High | Banzai markdown rendering pipeline - GitLab Flavored Markdown placeholder post-filter (Banzai::Filter::PlaceholdersPostFilter), which substitutes %{...} placeholder variables (e.g. %{latest_tag}, %{project_title}, %{project_path}) into already-rendered HTML. | [`e1acd86b`](https://gitlab.com/gitlab-org/gitlab/-/commit/e1acd86bb53340ce2836c7bb23f076de165226b5) | | 2026-03-10 | [CVE-2026-1090](https://nvd.nist.gov/vuln/detail/CVE-2026-1090) | High | Banzai markdown rendering pipeline (reference redaction + markdown placeholders post-processing) | [`e6bac2a8`](https://gitlab.com/gitlab-org/gitlab/-/commit/e6bac2a88998dc6b54a5715a509763c5c74352f7) | | 2026-03-10 | [CVE-2026-1182](https://nvd.nist.gov/vuln/detail/CVE-2026-1182) | Medium | Banzai markdown render pipeline / reference redaction (lib/banzai) | [`e6bac2a8`](https://gitlab.com/gitlab-org/gitlab/-/commit/e6bac2a88998dc6b54a5715a509763c5c74352f7) | | 2026-04-21 | [CVE-2026-5377](https://nvd.nist.gov/vuln/detail/CVE-2026-5377) | Medium | Banzai GFM markdown rendering pipeline (HTML sanitization + reference redaction) | [`2349dfb3`](https://gitlab.com/gitlab-org/gitlab/-/commit/2349dfb3609429a5be6a96859935cf841b775950) | | 2026-05-13 | [CVE-2026-6335](https://nvd.nist.gov/vuln/detail/CVE-2026-6335) | Medium | Banzai markdown rendering / HTML sanitization pipeline (lib/banzai/filter) | [`f06762cf`](https://gitlab.com/gitlab-org/gitlab/-/commit/f06762cfa84b0832830ab9a0bcd602da41cc6e60) | ### G21. Log redaction relies on an opt-in denylist that omits the sensitive param *recurring, 8 findings* **Root cause.** Sensitive values reach logs because redaction is a hand-maintained denylist / opt-in per-route declaration (filter_parameters, route_setting :log_safety, NGINX/AuthLogger param lists) that omits the relevant key (token/query/value/webhook URL), and access tokens are accepted as URL query params written verbatim. **Prevent.** No log sink writes request params/paths without central masking; secret-bearing params are denied-by-default; a test sweeps logged fields for known secret keys. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2024-08-06 | [CVE-2024-7554](https://nvd.nist.gov/vuln/detail/CVE-2024-7554) | Medium | Rack::Attack rate-limit logging (lib/gitlab/metrics/subscribers/rack_attack.rb) — Gitlab::AuthLogger auth.log | [`9ee1310a`](https://gitlab.com/gitlab-org/gitlab/-/commit/9ee1310ad76bceb5f45cb04ea4534c71efa90255) | | 2024-08-06 | [CVE-2024-7586](https://nvd.nist.gov/vuln/detail/CVE-2024-7586) | Medium | webhooks / audit events (EE) | [`82726dd8`](https://gitlab.com/gitlab-org/gitlab/-/commit/82726dd897601e1212641d2c4d1975a4f63b1032) | | 2024-09-11 | [CVE-2024-4472](https://nvd.nist.gov/vuln/detail/CVE-2024-4472) | Medium | graphql-logging (GraphQL instrumentation tracer / logger analyzer) + Dependency Proxy for Packages settings mutation | [`f52d37ba`](https://gitlab.com/gitlab-org/gitlab/-/commit/f52d37ba60af4a6411a2a896bd3232a3001368b5) | | 2024-12-10 | [CVE-2024-12292](https://nvd.nist.gov/vuln/detail/CVE-2024-12292) | Medium | Request logging (Rails config.filter_parameters / Lograge) for the GraphQL API | [`99f19ca5`](https://gitlab.com/gitlab-org/gitlab/-/commit/99f19ca570e8) | | 2025-01-08 | [CVE-2025-0194](https://nvd.nist.gov/vuln/detail/CVE-2025-0194) | Medium | Auth logging / rate limiting (Gitlab::AuthLogger, ApplicationRateLimiter, auth blocklist and request middlewares) | [`4f778ed3`](https://gitlab.com/gitlab-org/gitlab/-/commit/4f778ed32ee45feb6ad66087108e2972ae2b9dee) | | 2026-01-07 | [CVE-2025-13611](https://nvd.nist.gov/vuln/detail/CVE-2025-13611) | Low | Terraform Module Registry (packages) request logging — bundled NGINX access-log request-URI redaction (lib/support/nginx/gitlab) | [`edba54c3`](https://gitlab.com/gitlab-org/gitlab/-/commit/edba54c35296c77a442a48258dcb7b15cd6b6a3b) | | 2026-06-23 | [CVE-2026-12053](https://nvd.nist.gov/vuln/detail/CVE-2026-12053) | High | Duo Workflows / Duo Agent Platform (Ai::DuoWorkflows) — Secret Detection False-Positive Detection flow, EE | [`8907ca00`](https://gitlab.com/gitlab-org/gitlab/-/commit/8907ca00e923bf81c7ade9d9b4fcefd1ec5e7637) | | 2026-06-23 | [CVE-2026-8330](https://nvd.nist.gov/vuln/detail/CVE-2026-8330) | Medium | CI/CD - Pipeline Schedules API (lib/api/ci/pipeline_schedules.rb) | [`9bfed31f`](https://gitlab.com/gitlab-org/gitlab/-/commit/9bfed31f0cd68d4631de1d46cecf4ec0550339cc) | ### G22. Server templates mark untrusted content html_safe to allow wrapper markup *recurring, 8 findings* **Root cause.** To wrap a value in fixed formatting markup (b/a/div via sprintf/simple_format) a Rails template or markup fallback calls .html_safe / simple_format on the whole string, disabling auto-escaping of the interpolated attacker value; markup-render fallbacks return raw input as html_safe on timeout. **Prevent.** Lint/rubocop against .html_safe on strings containing interpolated user data; render fallbacks must sanitize before html_safe. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2024-02-20 | [CVE-2024-1451](https://nvd.nist.gov/vuln/detail/CVE-2024-1451) | High | User profile page rendering (app/views/users/show) — pronouns/pronunciation display | [`0fafb296`](https://gitlab.com/gitlab-org/gitlab/-/commit/0fafb29660c08e72b87bd79d792da802c566b650) | | 2024-06-25 | [CVE-2024-4901](https://nvd.nist.gov/vuln/detail/CVE-2024-4901) | High | Notes / discussions — legacy client-side notes rendering (deprecated_notes.js) of commit-list system notes | [`4c970a30`](https://gitlab.com/gitlab-org/gitlab/-/commit/4c970a3095e06a3406bb0cbcc2286d637ee3128c) | | 2024-10-09 | [CVE-2024-6530](https://nvd.nist.gov/vuln/detail/CVE-2024-6530) | High | OAuth provider / Doorkeeper application authorization (consent) page | [`b5cf4d28`](https://gitlab.com/gitlab-org/gitlab/-/commit/b5cf4d286ae83033912e342177a501ffc2ad6a53) | | 2025-03-26 | [CVE-2025-0811](https://nvd.nist.gov/vuln/detail/CVE-2025-0811) | High | Markup rendering / AsciiDoc (lib/gitlab/asciidoc.rb, Markup::RenderingService, MarkupHelper) | [`e6fbb87b`](https://gitlab.com/gitlab-org/gitlab/-/commit/e6fbb87bfa3ee2bc00d0a62b685bc540488a86dd) | | 2025-12-10 | [CVE-2025-12734](https://nvd.nist.gov/vuln/detail/CVE-2025-12734) | Low | Issuable views / merge request delete confirmation dialog (app/views/shared/issuable + confirm_via_gl_modal frontend util) | [`ecff386c`](https://gitlab.com/gitlab-org/gitlab/-/commit/ecff386cbf2f) | | 2026-02-09 | [CVE-2026-1282](https://nvd.nist.gov/vuln/detail/CVE-2026-1282) | Low | Labels UI rendering (LabelsHelper, project/group labels list) | [`7df7f72b`](https://gitlab.com/gitlab-org/gitlab/-/commit/7df7f72b65c62bdf17f0861f3bd3d2a17e56855a) | | 2026-05-13 | [CVE-2025-12669](https://nvd.nist.gov/vuln/detail/CVE-2025-12669) | Medium | Achievements (group achievements) email notifications | [`efa1eb88`](https://gitlab.com/gitlab-org/gitlab/-/commit/efa1eb888ea074aeaab3811ac58f1bfe6dc99065) | | 2026-07-07 | [CVE-2026-13320](https://nvd.nist.gov/vuln/detail/CVE-2026-13320) | High | Markup rendering (Gitlab::OtherMarkup / Markup::RenderingService) for repository blobs and wiki pages | [`30bbd9a7`](https://gitlab.com/gitlab-org/gitlab/-/commit/30bbd9a72288f5de8d9acd988f9b1fbfef0599ed) | ### G23. SSRF validation done once at config/ingress, not at the actual fetch *recurring, 8 findings* **Root cause.** User-supplied URLs are validated by the Rails UrlBlocker only at configuration-save or ingress time, while the real outbound request happens later in Gitaly/Workhorse/libcurl/Typhoeus which re-resolves DNS and follows redirects without re-validation, so TOCTOU/DNS-rebind/redirect reaches internal targets. **Prevent.** No outbound fetch of a user-supplied URL may occur without an IP-pinned, redirect-revalidating UrlBlocker check at the connection layer; enforced by wrapping the HTTP/Gitaly clients. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2024-09-11 | [CVE-2024-8635](https://nvd.nist.gov/vuln/detail/CVE-2024-8635) | High | Package registry - Dependency Proxy for packages (Maven upstream proxy) | [`6847e3a6`](https://gitlab.com/gitlab-org/gitlab/-/commit/6847e3a69e700ba2ca0dfa5a04d2448a2bf53d27) | | 2024-10-09 | [CVE-2024-8977](https://nvd.nist.gov/vuln/detail/CVE-2024-8977) | High | Product Analytics (EE) — Cube data query proxy service and Snowplow/funnel configurator workers | [`ac39cbe4`](https://gitlab.com/gitlab-org/gitlab/-/commit/ac39cbe4c47622259b06b92f4557d697fd2a8831) | | 2025-02-11 | [CVE-2024-9870](https://nvd.nist.gov/vuln/detail/CVE-2024-9870) | Medium | Remote Development / Workspaces (ee/lib/remote_development/workspace_operations/create) — devfile processing pipeline | [`16659a9e`](https://gitlab.com/gitlab-org/gitlab/-/commit/16659a9efb33ec22055b927fd716f5acc80361e9) | | 2026-02-09 | [CVE-2025-12073](https://nvd.nist.gov/vuln/detail/CVE-2025-12073) | Medium | Project/repository import (Import::UrlController + Import::ValidateRemoteGitEndpointService) | [`bd4d25f9`](https://gitlab.com/gitlab-org/gitlab/-/commit/bd4d25f9928e4f2bf68c87086bdc0b9f8615bd74) | | 2026-02-09 | [CVE-2025-12575](https://nvd.nist.gov/vuln/detail/CVE-2025-12575) | Medium | Virtual Registries (Maven/Container package proxy) - remote upstream availability check service (EE) | [`30638adc`](https://gitlab.com/gitlab-org/gitlab/-/commit/30638adc48712250c120a5696e5b697358a36bd1) | | 2026-05-13 | [CVE-2026-7471](https://nvd.nist.gov/vuln/detail/CVE-2026-7471) | Low | Virtual Registries (EE) — remote upstream file-fetch / redirect handling (Maven & container virtual registries) | [`9b134279`](https://gitlab.com/gitlab-org/gitlab/-/commit/9b134279b3d5) | | 2026-06-10 | [CVE-2026-9204](https://nvd.nist.gov/vuln/detail/CVE-2026-9204) | Medium | Repository import (import-by-URL) — Gitaly CreateRepositoryFromURL and its handling of remote-advertised secondary URLs | not publicly recorded | | 2026-06-23 | [CVE-2026-12635](https://nvd.nist.gov/vuln/detail/CVE-2026-12635) | None | Repository mirroring (pull mirror import + push remote mirror sync) | [`ab204c63`](https://gitlab.com/gitlab-org/gitlab/-/commit/ab204c63fe4ba5e2b48ef7fa9f23d9fcd0bdd50f) | ### G24. Membership/org restrictions enforced in policy but not on the write path *recurring, 7 findings* **Root cause.** Restrictions modeled as narrow policy abilities or web-server config (disable_invite_members, membership_lock, forking-outside-group, IP via X-Forwarded-For, accessRequest role serialization) are not consulted by the member/fork creation services which authorize against a broader ability, so the restriction is bypassed. **Prevent.** Member/fork creation services check the specific restriction ability centrally; a test asserts the restriction blocks every creation path. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2025-06-11 | [CVE-2025-5982](https://nvd.nist.gov/vuln/detail/CVE-2025-5982) | Low | Group IP access restriction (EE) client-IP derivation from X-Forwarded-For / web-server proxy configuration | [`17c931dc`](https://gitlab.com/gitlab-org/gitlab/-/commit/17c931dc093121d9ff84f9d227647aa8575f6e06) | | 2025-06-24 | [CVE-2025-2938](https://nvd.nist.gov/vuln/detail/CVE-2025-2938) | Low | members / project membership (Members page role drawer, access requests) | [`9249ebcc`](https://gitlab.com/gitlab-org/gitlab/-/commit/9249ebcc259b9e4b95bba121dd82f9b6ffc39746) | | 2025-07-09 | [CVE-2025-3396](https://nvd.nist.gov/vuln/detail/CVE-2025-3396) | Medium | Projects :: Fork service (EE group forking protection) | [`1d997dfa`](https://gitlab.com/gitlab-org/gitlab/-/commit/1d997dfac706f608f84eb84b2b54bff8c6b04231) | | 2025-07-09 | [CVE-2025-4972](https://nvd.nist.gov/vuln/detail/CVE-2025-4972) | Low | EE group membership / invitations (Members::Groups::CreatorService and Groups::GroupLinks::CreateService service layer) | [`68abcb92`](https://gitlab.com/gitlab-org/gitlab/-/commit/68abcb923ad37efcb4e809ca8473e917e4412b83) | | 2025-07-09 | [CVE-2025-6168](https://nvd.nist.gov/vuln/detail/CVE-2025-6168) | Low | Project membership management (Members::Projects::CreatorService / Members REST API, EE project member-invite restrictions) | [`4ea90f01`](https://gitlab.com/gitlab-org/gitlab/-/commit/4ea90f015abe476a1d110af1cabc828ec0458170) | | 2025-10-21 | [CVE-2025-6601](https://nvd.nist.gov/vuln/detail/CVE-2025-6601) | Low | Members / access-request approval workflow (Groups & Projects), EE membership_lock enforcement | [`d08571b6`](https://gitlab.com/gitlab-org/gitlab/-/commit/d08571b691ada69d91807e2a8ec0b371bff267ad) | | 2026-04-21 | [CVE-2025-9957](https://nvd.nist.gov/vuln/detail/CVE-2025-9957) | Low | authorization / declarative policies (project fork relationships) | [`3d89db11`](https://gitlab.com/gitlab-org/gitlab/-/commit/3d89db1152d1b4a4f48e2cfb8c1069132b722db4) | ### G25. The user resolved for the 2FA/reset gate differs from the one authenticated *recurring, 7 findings* **Root cause.** The account is resolved through two paths that normalize/lookup differently (case/whitespace, primary-vs-any-email, session-state-vs-login-param, permissive email regexp), and the WebAuthn/passkey verification boolean is discarded, so the 2FA-enablement/password-reset gate evaluates a different (or no-2FA) user than the one actually authenticated. **Prevent.** First-factor and second-factor/reset must resolve the identical normalized user; a test asserts padded/secondary/case-variant logins cannot split the gate; verification result is checked. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2024-02-20 | [CVE-2024-1525](https://nvd.nist.gov/vuln/detail/CVE-2024-1525) | Medium | Authentication / password reset (Devise) - RecoverableByAnyEmail concern and PasswordsController; interaction with LDAP-only users | [`7a15c766`](https://gitlab.com/gitlab-org/gitlab/-/commit/7a15c7669cbb8dc6bbd83ea0440b83fc9c8c7ca4) | | 2024-04-24 | [CVE-2024-1347](https://nvd.nist.gov/vuln/detail/CVE-2024-1347) | Medium | User/email format validation & email domain-based signup/group-membership restrictions (app/validators + app/models + ee/app/models member domain limitation) | [`0d03608d`](https://gitlab.com/gitlab-org/gitlab/-/commit/0d03608df342ccf24ef6fc55def837dbedd672bf) | | 2025-05-21 | [CVE-2024-12093](https://nvd.nist.gov/vuln/detail/CVE-2024-12093) | Medium | SAML authentication / OmniAuth 2FA bypass (lib/gitlab/auth/saml) | [`56e882a0`](https://gitlab.com/gitlab-org/gitlab/-/commit/56e882a0dbe75d773c31a8fc250e0b19d018f22f) | | 2025-05-21 | [CVE-2025-0605](https://nvd.nist.gov/vuln/detail/CVE-2025-0605) | Medium | Group/project membership - access request acceptance (Member model lifecycle callbacks) | [`9ab5c2e1`](https://gitlab.com/gitlab-org/gitlab/-/commit/9ab5c2e1c7b62cf061c9317efacde70a7dba6095) | | 2025-12-10 | [CVE-2025-11984](https://nvd.nist.gov/vuln/detail/CVE-2025-11984) | Medium | Authentication / two-factor (2FA) session handling (SessionsController + AuthenticatesWithTwoFactor concern) | [`ac6a2224`](https://gitlab.com/gitlab-org/gitlab/-/commit/ac6a2224c86512fc4e617d1dbaacbf8eaa4b6bd4) | | 2026-01-20 | [CVE-2026-0723](https://nvd.nist.gov/vuln/detail/CVE-2026-0723) | High | Authentication / two-factor sign-in — WebAuthn & passkey assertion verification services | [`f3002eb8`](https://gitlab.com/gitlab-org/gitlab/-/commit/f3002eb83cfcc360edc0794da82d62a40581d310) | | 2026-03-24 | [CVE-2026-2745](https://nvd.nist.gov/vuln/detail/CVE-2026-2745) | Medium | authentication / session sign-in (Devise SessionsController + two-factor gate) | [`79a2865f`](https://gitlab.com/gitlab-org/gitlab/-/commit/79a2865f94cfb147c6d4940d5e641efe310d0fc6) | ### G26. Credential decoded/verified before any size check *recurring, 7 findings* **Root cause.** Authentication paths (Jira Connect JWT, CI job token, routable runner token, SAML) pass the raw unbounded attacker-supplied credential straight into an expensive decode/HMAC/base64/DB lookup before validating its length, and the size cap lived at one entry point rather than the shared finder every consumer funnels through. **Prevent.** Every credential is length-checked in the shared finder before decode; a test asserts oversized tokens are rejected pre-decode on all routes. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2025-09-09 | [CVE-2025-2256](https://nvd.nist.gov/vuln/detail/CVE-2025-2256) | High | SAML authentication (OmniAuth SAML strategy backed by the ruby-saml gem) | [`2940ed09`](https://gitlab.com/gitlab-org/gitlab/-/commit/2940ed09a2b17925574b63e63c4d8e5ddb8f68e2) | | 2026-01-20 | [CVE-2025-13927](https://nvd.nist.gov/vuln/detail/CVE-2025-13927) | High | Jira Connect integration (Atlassian JWT authentication) | [`aec71ea6`](https://gitlab.com/gitlab-org/gitlab/-/commit/aec71ea61096f8386a1f325b9655cd8f027dc1f7) | | 2026-01-20 | [CVE-2025-13928](https://nvd.nist.gov/vuln/detail/CVE-2025-13928) | High | API authentication / CI job-token auth finders (lib/gitlab/auth) | [`b5eaaedf`](https://gitlab.com/gitlab-org/gitlab/-/commit/b5eaaedff99e39f8ea44279e9a24acb08fc6e3ca) | | 2026-01-20 | [CVE-2026-1102](https://nvd.nist.gov/vuln/detail/CVE-2026-1102) | Medium | CI/CD job-token request authentication (lib/gitlab/auth/auth_finders) | [`f77ca8e0`](https://gitlab.com/gitlab-org/gitlab/-/commit/f77ca8e040cf8c1afbfcc511fb536e32e26cacc8) | | 2026-02-24 | [CVE-2026-1662](https://nvd.nist.gov/vuln/detail/CVE-2026-1662) | High | Jira Connect integration (jira_connect events lifecycle endpoint / asymmetric JWT verification) | [`b81aef7c`](https://gitlab.com/gitlab-org/gitlab/-/commit/b81aef7c536fc2220024827210ba8fce5c5faf88) | | 2026-02-24 | [CVE-2026-1725](https://nvd.nist.gov/vuln/detail/CVE-2026-1725) | Medium | CI runner token authentication - routable token decoder (Authn::TokenField::Decoders::V1::RoutablePayload) | [`f2fb676c`](https://gitlab.com/gitlab-org/gitlab/-/commit/f2fb676ca8ebc68da15bb72a375fb79bf4b438fd) | | 2026-05-13 | [CVE-2026-1659](https://nvd.nist.gov/vuln/detail/CVE-2026-1659) | High | CI/CD job-token authentication (Ci::AuthJobFinder used by the unauthenticated Runner jobs API) | [`b5ebd721`](https://gitlab.com/gitlab-org/gitlab/-/commit/b5ebd7218e1e8b039dced55243149c047fe2a6d7) | ### G27. EE vulnerability/security report viewers render raw scanner strings as HTML *recurring, 7 findings* **Root cause.** The EE Vulnerability Management Vue viewers (Code Flow, Solution card, generic finding table, code-quality body) treat attacker-controllable SAST/scanner report strings (file names, raw blobs, finding keys) as pre-escaped HTML and bind them via v-html/v-safe-html, so the unrecognized-language / falsy-html branch routes raw report bytes into the DOM. **Prevent.** Component invariant: report-sourced fields are typed as text and only a single server-sanitized field may enter an HTML sink; enforced by test + lint on the code-flow/report components. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2024-11-12 | [CVE-2024-8180](https://nvd.nist.gov/vuln/detail/CVE-2024-8180) | Medium | EE Vulnerability Management - Vulnerability 'Code Flow' viewer (Vue frontend, ee/app/assets/javascripts/vue_shared/components/code_flow) | [`5e822c1e`](https://gitlab.com/gitlab-org/gitlab/-/commit/5e822c1e27a1b26518c6ec8ef4ca8f4650f84c82) | | 2024-12-10 | [CVE-2024-8179](https://nvd.nist.gov/vuln/detail/CVE-2024-8179) | Medium | EE Security Dashboard / Vulnerability Report - vulnerability details "code flow" file-content viewer (frontend Vue components) | [`558af31a`](https://gitlab.com/gitlab-org/gitlab/-/commit/558af31a582d5f2136ad90ece53bb4c17d38918b) | | 2025-12-10 | [CVE-2025-8405](https://nvd.nist.gov/vuln/detail/CVE-2025-8405) | High | EE Vulnerability Management — SAST 'Code Flow' display (Vue frontend: ee/app/assets/javascripts/vue_shared/components/code_flow/ + ee/app/assets/javascripts/vue_shared/vulnerabilities/components/vulnerability_file_content_viewer.vue) | not publicly recorded | | 2026-02-09 | [CVE-2025-14560](https://nvd.nist.gov/vuln/detail/CVE-2025-14560) | High | Vulnerability Management / Security Dashboard - EE code flow file viewer (Vue frontend) | [`569a755c`](https://gitlab.com/gitlab-org/gitlab/-/commit/569a755c7f510bd3313c386de0f2fa41f2ec9684) | | 2026-03-24 | [CVE-2026-2995](https://nvd.nist.gov/vuln/detail/CVE-2026-2995) | High | Vulnerability/Security Report UI (EE) — vulnerability finding 'Solution' card rendering in the Security Dashboard / vulnerability detail footer | [`92c93b63`](https://gitlab.com/gitlab-org/gitlab/-/commit/92c93b636f25b894e9d0fdf78e0cd199dec1e528) | | 2026-04-07 | [CVE-2026-1516](https://nvd.nist.gov/vuln/detail/CVE-2026-1516) | Medium | CI / Code Quality report frontend widget (Vue component codequality_issue_body.vue rendered in the merge-request / pipeline Code Quality view) | [`450b150c`](https://gitlab.com/gitlab-org/gitlab/-/commit/450b150cd8e3a44751df0278333263a4832a8bf8) | | 2026-07-07 | [CVE-2026-6896](https://nvd.nist.gov/vuln/detail/CVE-2026-6896) | High | Vulnerability Management / Security Reports (GitLab EE) — vulnerability finding detail rendering (generic report 'table' detail type) | [`9fbd696f`](https://gitlab.com/gitlab-org/gitlab/-/commit/9fbd696fbd20a15472a8a06f6259744996b87d5b) | ### G28. Rendered-markdown reference redaction is a post-process, not an invariant *recurring, 6 findings* **Root cause.** Per-viewer reference redaction (hiding references the reader cannot see) is applied only by a Banzai post-process on freshly rendered HTML; any path that serves cached *_html, marks content :rendered, exposes rendered_markup, or resolves body via a bypassing interface skips it. **Prevent.** No serializer/presenter may emit *_html without passing through per-current_user reference redaction; enforced by a shared render-exposure helper + test. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2024-09-24 | [CVE-2024-8974](https://nvd.nist.gov/vuln/detail/CVE-2024-8974) | Low | Notes / system notes visibility (app/models/note.rb, Banzai reference redaction) | [`884df0d6`](https://gitlab.com/gitlab-org/gitlab/-/commit/884df0d68bb3f3f2a2029b2851d202949780dd3b) | | 2025-05-21 | [CVE-2025-0679](https://nvd.nist.gov/vuln/detail/CVE-2025-0679) | Medium | GraphQL API - Notes (issue_email_participants system notes) | [`53605f1f`](https://gitlab.com/gitlab-org/gitlab/-/commit/53605f1fec66d5ad2479d925f02456dc56505cc8) | | 2026-03-10 | [CVE-2026-0602](https://nvd.nist.gov/vuln/detail/CVE-2026-0602) | Medium | Snippets rendering / Banzai markdown reference redaction (blob viewer) | [`8bb5c0fb`](https://gitlab.com/gitlab-org/gitlab/-/commit/8bb5c0fb5fa78a9369d5f81b701d6ceab3f5a2db) | | 2026-03-10 | [CVE-2026-1732](https://nvd.nist.gov/vuln/detail/CVE-2026-1732) | Medium | REST API (Grape) issuable/label/project entities; Banzai markdown reference rendering & redaction | [`590b4aea`](https://gitlab.com/gitlab-org/gitlab/-/commit/590b4aea9321f60a82860295c3ad87eb4b6f87f6) | | 2026-06-23 | [CVE-2026-2238](https://nvd.nist.gov/vuln/detail/CVE-2026-2238) | Medium | Commit notes / discussions rendering (Rapid Diffs commit discussions endpoint + REST commit-comments API) | [`235e1530`](https://gitlab.com/gitlab-org/gitlab/-/commit/235e15302bf3b052cc2f1d01b673554b8212655d) | | 2026-07-07 | [CVE-2026-7492](https://nvd.nist.gov/vuln/detail/CVE-2026-7492) | Medium | source_code_management / commit discussions (cross-reference system notes on commit pages + commit comments REST API) | [`abe9b0e3`](https://gitlab.com/gitlab-org/gitlab/-/commit/abe9b0e39718ae58ea59b048f926952e8a3de85a) | ### G29. AI/Duo agent authorization uses the wrong identity or a coarse tier check *recurring, 5 findings* **Root cause.** Duo Agent/Workflow authorization confuses a composite/service-account identity with an ordinary one, caches a user-dependent condition per subject, resolves the run-as identity from project ownership instead of the actor, looks up namespaces without read authorization, and checks only coarse tier/feature availability, so AI agents act with unintended privileges. **Prevent.** AI agent runs authorize the actual actor with a per-user (not per-subject) condition and the specific flow/namespace ability; tests per path. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2024-06-25 | [CVE-2024-3115](https://nvd.nist.gov/vuln/detail/CVE-2024-3115) | Medium | GitLab Duo Chat (AI abstraction layer) / Group-SAML SSO session enforcement | [`c7eabd8a`](https://gitlab.com/gitlab-org/gitlab/-/commit/c7eabd8a76e035e439d27734310dd3d6c83bc2c0) | | 2025-11-11 | [CVE-2025-11865](https://nvd.nist.gov/vuln/detail/CVE-2025-11865) | Medium | GitLab Duo Workflow (Duo Agent Platform) authorization policy — ee/app/policies/ai/duo_workflows | [`8d86f812`](https://gitlab.com/gitlab-org/gitlab/-/commit/8d86f81230f96b8a031793ebbd0a5e12e3c0766f) | | 2026-03-24 | [CVE-2026-4363](https://nvd.nist.gov/vuln/detail/CVE-2026-4363) | Low | GitLab EE — AI / Duo Agent Platform (Duo Workflow) authorization; DeclarativePolicy conditions in ee/app/policies (GroupPolicy, ProjectPolicy) and the Ai::UserAuthorizable concern | [`f6fb6845`](https://gitlab.com/gitlab-org/gitlab/-/commit/f6fb68457b26ac2a2970eaf26f40c502ead2dcce) | | 2026-05-26 | [CVE-2026-4868](https://nvd.nist.gov/vuln/detail/CVE-2026-4868) | High | GitLab EE Vulnerability Management / Duo AI agentic workflow triggers (Sidekiq workers that start SAST FP-detection, secret-detection FP-detection, and vulnerability-resolution Duo workflows) | [`8a239fad`](https://gitlab.com/gitlab-org/gitlab/-/commit/8a239fada5445006b65890cd9197e74e4bfd61f0) | | 2026-05-26 | [CVE-2026-5296](https://nvd.nist.gov/vuln/detail/CVE-2026-5296) | Medium | Duo Agent Platform / AI Catalog foundational flows (Ai::DuoWorkflows workflow creation + Ai::Catalog::ItemConsumerPolicy authorization) | [`1df56c8c`](https://gitlab.com/gitlab-org/gitlab/-/commit/1df56c8c4d9686773ee5ed2e58a18cf0256cc963) | ### G30. Analytics-dashboard visualization descriptors passed to render as HTML *recurring, 5 findings* **Root cause.** EE customizable analytics dashboards accept user-authored YAML panel/field descriptors and forward them verbatim into bootstrap-vue b-table thAttr/tdAttr or spread componentProps via v-bind, because the JSON schema lacks additionalProperties:false and there is no allowlist of descriptor properties. **Prevent.** Schema rule: every user-authored dashboard descriptor object sets additionalProperties:false and props are validated against an allowlist before v-bind; CI schema test. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2024-11-12 | [CVE-2024-8648](https://nvd.nist.gov/vuln/detail/CVE-2024-8648) | Medium | EE Analytics Dashboards (Product Analytics) - DataTable visualization frontend (Vue) | [`80eb4726`](https://gitlab.com/gitlab-org/gitlab/-/commit/80eb472665ef) | | 2026-04-07 | [CVE-2026-4332](https://nvd.nist.gov/vuln/detail/CVE-2026-4332) | Medium | Customizable analytics dashboards (EE) — DataTable visualization / analytics_visualization JSON schema validator | [`9b26b847`](https://gitlab.com/gitlab-org/gitlab/-/commit/9b26b84793c38621ba30bd7905ef6b48c2959b65) | | 2026-05-13 | [CVE-2026-7377](https://nvd.nist.gov/vuln/detail/CVE-2026-7377) | High | Customizable analytics dashboards (EE) — DataTable visualization renderer | [`7b89db13`](https://gitlab.com/gitlab-org/gitlab/-/commit/7b89db13a9204e21487b6ca5a29edaafe4c75b2d) | | 2026-06-10 | [CVE-2026-10087](https://nvd.nist.gov/vuln/detail/CVE-2026-10087) | High | EE Analytics Dashboards (customizable analytics dashboard panel rendering, ee/app/assets/javascripts/analytics/analytics_dashboards) | [`356dd57b`](https://gitlab.com/gitlab-org/gitlab/-/commit/356dd57b442ac4ca19de4754c6571eb5fb4bee06) | | 2026-06-23 | [CVE-2026-10086](https://nvd.nist.gov/vuln/detail/CVE-2026-10086) | High | GitLab EE Analytics Dashboards / Value Streams Dashboard — the `value_stream` analytics-dashboard data source (ee/app/assets/javascripts/analytics/analytics_dashboards/data_sources/value_stream.js) | [`a85a9b52`](https://gitlab.com/gitlab-org/gitlab/-/commit/a85a9b52eac6583d77d6c31e24a1c73ba03614f0) | ### G31. Resolution/iteration loops lack a cycle or iteration bound *recurring, 5 findings* **Root cause.** Loops that walk a graph or stream (wiki/git-extension redirect resolution, work-item hierarchy expansion, HttpIO gzip read, PAT scope parse) have no cycle detection or iteration/EOF bound, so a crafted cycle or malformed input drives non-termination or unbounded allocation. **Prevent.** Every path-climbing/graph-walk/stream loop carries a hard iteration bound and cycle guard; regression tests with cyclic/malformed input. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2025-01-08 | [CVE-2024-6324](https://nvd.nist.gov/vuln/detail/CVE-2024-6324) | Medium | Work Items / Epics hierarchy tree widget (frontend Vue) | [`2fdbe509`](https://gitlab.com/gitlab-org/gitlab/-/commit/2fdbe509828bc42960f70c576b1d94073610634c) | | 2025-01-14 | [CVE-2025-0290](https://nvd.nist.gov/vuln/detail/CVE-2025-0290) | Medium | CI job artifacts metadata parsing / HttpIO object-storage streaming | [`978fa9a5`](https://gitlab.com/gitlab-org/gitlab/-/commit/978fa9a5fee79895a493d63b32c9ea08e73c8c49) | | 2025-02-11 | [CVE-2024-12379](https://nvd.nist.gov/vuln/detail/CVE-2024-12379) | Medium | system_access / Personal Access Tokens (UserSettings::PersonalAccessTokensController) | [`6f4aea90`](https://gitlab.com/gitlab-org/gitlab/-/commit/6f4aea90bd0b6bfe61109173aaeb422d05e6f870) | | 2025-06-11 | [CVE-2025-0673](https://nvd.nist.gov/vuln/detail/CVE-2025-0673) | High | Rails web application - ProjectsController (project show / .git-extension redirect) | [`063e73be`](https://gitlab.com/gitlab-org/gitlab/-/commit/063e73be3df53e23277ebab797f168ec8a42fe2c) | | 2026-01-20 | [CVE-2025-13335](https://nvd.nist.gov/vuln/detail/CVE-2025-13335) | Medium | Wikis - project/group wiki redirect resolution (app/controllers/concerns/wiki_actions.rb) | [`0361dc61`](https://gitlab.com/gitlab-org/gitlab/-/commit/0361dc610583a6eb41c0fd793e7a50750f16cfd7) | ### G32. Bare git ref names resolved with ambiguous branch/tag precedence *recurring, 5 findings* **Root cause.** Display/authorization/download paths pass a bare user-supplied ref name to git resolution instead of the disambiguated fully-qualified ref, and git precedence (tags before branches, or vice-versa) means a name that exists as both silently resolves to the unintended object, bypassing protection or leaking content. **Prevent.** Dangerous ref operations accept only fully-qualified refs; a type check/lint forbids passing a bare ref name to raw/archive/resolve APIs. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2024-08-06 | [CVE-2024-3958](https://nvd.nist.gov/vuln/detail/CVE-2024-3958) | Medium | Source code / repository browsing — Git ref resolution & display (Projects::BlobController, Projects::CommitsController, Projects::TreeController; lib/extracts_ref) | [`a1fa5a60`](https://gitlab.com/gitlab-org/gitlab/-/commit/a1fa5a60d3f8b4d420e65baaf9eb631e2fa9bdf0) | | 2025-08-26 | [CVE-2025-5101](https://nvd.nist.gov/vuln/detail/CVE-2025-5101) | Medium | source_code_management / repository ref resolution (raw file view + repository archive download) | [`014c0adf`](https://gitlab.com/gitlab-org/gitlab/-/commit/014c0adf30161507fcc3e528b18952da7af9c9bf) | | 2026-05-13 | [CVE-2026-1338](https://nvd.nist.gov/vuln/detail/CVE-2026-1338) | Medium | Container Registry - protected tag rules / tag deletion (Projects::ContainerRepository::Gitlab::DeleteTagsService) | [`22010568`](https://gitlab.com/gitlab-org/gitlab/-/commit/22010568982cf12301b50a36e0546af3ee3ef1d7) | | 2026-05-26 | [CVE-2026-8716](https://nvd.nist.gov/vuln/detail/CVE-2026-8716) | Medium | CI/CD pipelines (parent-child pipeline / bridge trigger jobs) | [`2416a9b9`](https://gitlab.com/gitlab-org/gitlab/-/commit/2416a9b978eefb3df45c9a7031a78d6647350ee6) | | 2026-07-07 | [CVE-2025-12506](https://nvd.nist.gov/vuln/detail/CVE-2025-12506) | Low | Repository browsing / source-code archive download (Projects::RepositoriesController#archive + blob/tree views, Gitlab::Git::Repository ref resolution) | [`a198e375`](https://gitlab.com/gitlab-org/gitlab/-/commit/a198e3756038) | ### G33. Web IDE workbench origin/framing isolation is not enforced end-to-end *recurring, 5 findings* **Root cause.** The Web IDE isolates the token-bearing VSCode workbench onto a dedicated origin, but the isolation depends on headers/paths that diverge: Workhorse and the asset middleware authorize on a raw path while serving from a normalized path, framing/COOP/CORP headers are missing, and the dedicated origin is a guessable hash of public data. **Prevent.** The path used for the workbench-asset deny check must equal the path used to serve; a single canonicalization function feeds both, asserted by test. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2024-05-21 | [CVE-2024-4835](https://nvd.nist.gov/vuln/detail/CVE-2024-4835) | High | Web IDE (VS Code editor fork) frontend assets — vendored @gitlab/web-ide extension-host bootstrap iframe | [`c848b946`](https://gitlab.com/gitlab-org/gitlab/-/commit/c848b946ee4867332692d15e6c27e8efaf37ae53) | | 2026-01-07 | [CVE-2025-13761](https://nvd.nist.gov/vuln/detail/CVE-2025-13761) | High | Web IDE / VSCode static asset serving (Rails middleware + GitLab Workhorse staticpages) | [`913e2bda`](https://gitlab.com/gitlab-org/gitlab/-/commit/913e2bdaedce283e8e670fe5df335a05d8ae6242) | | 2026-02-09 | [CVE-2025-7659](https://nvd.nist.gov/vuln/detail/CVE-2025-7659) | High | Web IDE (IdeController + gitlab_web_ide client workbench config) | [`1b6560f2`](https://gitlab.com/gitlab-org/gitlab/-/commit/1b6560f298b2360c1940c779d34d15c1b79907a6) | | 2026-04-21 | [CVE-2026-5816](https://nvd.nist.gov/vuln/detail/CVE-2026-5816) | High | workhorse static asset serving / Web IDE (VSCode workbench) asset authorization middleware | [`8e199fda`](https://gitlab.com/gitlab-org/gitlab/-/commit/8e199fda3ba990a16f0eb4f5277850085c121758) | | 2026-06-23 | [CVE-2026-10712](https://nvd.nist.gov/vuln/detail/CVE-2026-10712) | High | GitLab Workhorse static asset serving / Web IDE (VSCode workbench) asset authorization | [`67ee069d`](https://gitlab.com/gitlab-org/gitlab/-/commit/67ee069d28bcb27fedff3e76bfa0927d257794a8) | ### G34. MR approval-rule edits do not check rule provenance / policy ownership *recurring, 4 findings* **Root cause.** MR approval rules mix user-editable and policy-managed (scan-result/code-owner) rules in one accepts_nested_attributes_for collection, and the edit/delete/params-filter paths trust the client-supplied rule id or enumerate only one protected subtype, so policy-enforced rules are edited/deleted via the generic edit permission. **Prevent.** The approval-rules filter excludes all non-user-defined rules by a single provenance property; a test covers scan-result and code-owner rules. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2024-06-25 | [CVE-2024-5430](https://nvd.nist.gov/vuln/detail/CVE-2024-5430) | Medium | Merge request approval rules / Security orchestration policies (merge request approval policy) - GraphQL approvalProjectRuleDelete and BranchRuleDelete mutations (EE) | [`69d61135`](https://gitlab.com/gitlab-org/gitlab/-/commit/69d6113572c1515f46ddfb1990aa746ae123c518) | | 2025-08-12 | [CVE-2025-8770](https://nvd.nist.gov/vuln/detail/CVE-2025-8770) | Medium | ee/app/services/approval_rules (Merge Request Approval Policies / scan result policy approval rules) | [`52e3fa2b`](https://gitlab.com/gitlab-org/gitlab/-/commit/52e3fa2bb2dd) | | 2025-10-15 | [CVE-2026-1751](https://nvd.nist.gov/vuln/detail/CVE-2026-1751) | Low | Merge request approval rules (EE) — approval-rule editing authorization policies | [`9cebf301`](https://gitlab.com/gitlab-org/gitlab/-/commit/9cebf3010f4b82b63be04f4a01bc70eae71f4b0b) | | 2026-05-13 | [CVE-2026-6063](https://nvd.nist.gov/vuln/detail/CVE-2026-6063) | Medium | EE merge request approval rules (ApprovalRules::ParamsFilteringService) | [`a411b6aa`](https://gitlab.com/gitlab-org/gitlab/-/commit/a411b6aa7c7533d5fe972d60f555d7336f53edf0) | ### G35. CI artifact accessibility check applied on some read paths but not all *recurring, 4 findings* **Root cause.** The fine-grained Ci::JobArtifact accessibility enum is enforced on the download path but omitted on sibling read paths (browse/raw, dependency dotenv propagation, runner dependent-job download, GraphQL manualVariables), which authorize only on coarse read_build, so restricted artifacts/variables leak. **Prevent.** All artifact content exposure runs through one accessibility gate; a test asserts browse/raw/download/dependency honor the enum identically. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2024-05-21 | [CVE-2024-5318](https://nvd.nist.gov/vuln/detail/CVE-2024-5318) | Medium | CI/CD job artifacts — Secure/scanning report artifact accessibility (access-level classification) | [`6ba8d8a4`](https://gitlab.com/gitlab-org/gitlab/-/commit/6ba8d8a40db735f992d2fa66b41484dcc6166afa) | | 2024-06-25 | [CVE-2024-3959](https://nvd.nist.gov/vuln/detail/CVE-2024-3959) | Medium | CI/CD pipeline variables - job artifact accessibility / dotenv dependency variables (app/models/ci/processable.rb) | [`50bd3b7b`](https://gitlab.com/gitlab-org/gitlab/-/commit/50bd3b7b0cdcedf7efdf3b8b1d8808a4e0aaab76) | | 2024-07-24 | [CVE-2024-7057](https://nvd.nist.gov/vuln/detail/CVE-2024-7057) | Medium | CI job artifacts — Projects::ArtifactsController (browse/raw artifact viewing endpoints) | [`502b6782`](https://gitlab.com/gitlab-org/gitlab/-/commit/502b678220abbc1427d2c9320d6e26deb4084234) | | 2025-08-12 | [CVE-2024-10219](https://nvd.nist.gov/vuln/detail/CVE-2024-10219) | Medium | CI runner API - job artifacts download endpoint (lib/api/ci) | [`00958b62`](https://gitlab.com/gitlab-org/gitlab/-/commit/00958b62ac3057f8ca301b875cb3e9baf5e7b0dd) | ### G36. The query validated for CSRF/scope differs from the query executed *recurring, 4 findings* **Root cause.** GLQL/GraphQL request dispatch validates one string/operation (by operationName, escaped copy, or introspection-vs-multiplex ordering) but executes a different one, and the bespoke controller context omits scope_validator/sessionless flags, so mutation/CSRF/scope checks inspect a benign operation while a different one runs. **Prevent.** CSRF/mutation/scope checks must operate on the same parsed document that executes; a test asserts validation and execution parse-identically and context carries scope_validator. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2024-06-25 | [CVE-2024-4994](https://nvd.nist.gov/vuln/detail/CVE-2024-4994) | High | GraphQL API request dispatch (app/controllers/graphql_controller.rb) | [`b5afa91a`](https://gitlab.com/gitlab-org/gitlab/-/commit/b5afa91ae27c8d9b11461ebeb03b25a230f5bc54) | | 2026-02-09 | [CVE-2025-14592](https://nvd.nist.gov/vuln/detail/CVE-2025-14592) | Low | GLQL API endpoint (Glql::BaseController) / GraphQL mutation scope authorization | [`f3c012ac`](https://gitlab.com/gitlab-org/gitlab/-/commit/f3c012ac44025e2c5a4c14b6573629bc6fecfe02) | | 2026-03-24 | [CVE-2026-3857](https://nvd.nist.gov/vuln/detail/CVE-2026-3857) | High | GraphQL API / GLQL endpoint (app/controllers/glql, app/services/analytics/glql) — CSRF / mutation-on-GET protection | [`e6544d5d`](https://gitlab.com/gitlab-org/gitlab/-/commit/e6544d5deb957c840f065c4f5bfda352e00fbffe) | | 2026-04-21 | [CVE-2026-4922](https://nvd.nist.gov/vuln/detail/CVE-2026-4922) | High | GraphQL API / GLQL controller (CSRF protection) | [`7094c42a`](https://gitlab.com/gitlab-org/gitlab/-/commit/7094c42a5ce3772e2ab6f74688aaa09f43c9e8a0) | ### G37. Package/tag protection is wired per-format instead of at one chokepoint *recurring, 4 findings* **Root cause.** Package-protection enforcement (protect_package!/CheckRuleExistenceService) and container tag-protection are opt-in per upload/authorize endpoint and per package format, so formats never integrated (Conan authorize, Helm, versionless Maven metadata, PyPI normalization, digest-as-tag) skip protection. **Prevent.** Every package/registry write passes through one protection-check chokepoint with format-normalized identity; a test asserts each format triggers it. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2026-02-24 | [CVE-2026-1747](https://nvd.nist.gov/vuln/detail/CVE-2026-1747) | Medium | Package Registry — Conan API (lib/api/conan, lib/api/concerns/packages/conan) | [`ebedeb1c`](https://gitlab.com/gitlab-org/gitlab/-/commit/ebedeb1c12f253bf57baf9c09b0651501da0d483) | | 2026-05-13 | [CVE-2026-3073](https://nvd.nist.gov/vuln/detail/CVE-2026-3073) | Medium | Package Registry - PyPI package protection rules (authorization) | [`68c4054b`](https://gitlab.com/gitlab-org/gitlab/-/commit/68c4054bf6d3ee4fde92b104f029d932bbcf6d36) | | 2026-05-13 | [CVE-2026-3607](https://nvd.nist.gov/vuln/detail/CVE-2026-3607) | Medium | packages/helm (Package Registry - Helm chart upload / package protection rules) | [`7bd62a0d`](https://gitlab.com/gitlab-org/gitlab/-/commit/7bd62a0d91775677ddc62b0331ca74c764b4a295) | | 2026-06-23 | [CVE-2026-5952](https://nvd.nist.gov/vuln/detail/CVE-2026-5952) | Medium | Package Registry - Maven packages API (workhorse upload authorize endpoint) / package protection rules | [`3ec9fb5f`](https://gitlab.com/gitlab-org/gitlab/-/commit/3ec9fb5fbf138f9cacd19e87a12ba62e6c67d254) | ### G38. Two parallel abilities/scopes guard one op; a lock/rule wired to only one *recurring, 4 findings* **Root cause.** The same operation is governed by two abilities at different scopes (Project vs object policy, instance vs group-cascaded lock, IP-restriction fail-open), and a restriction/lock/prevent is attached to only one, so authorizing against the other subject bypasses it. **Prevent.** A policy test asserts that for each dual-ability operation, every restriction is present on both abilities/scopes. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2024-08-20 | [CVE-2024-3127](https://nvd.nist.gov/vuln/detail/CVE-2024-3127) | Medium | Authorization / DeclarativePolicy — EE group policy (group-level IP restriction / IP allowlist enforcement) | [`d486737c`](https://gitlab.com/gitlab-org/gitlab/-/commit/d486737cc363455d6d71d4bc2bcc55f7858de87a) | | 2026-05-13 | [CVE-2026-2900](https://nvd.nist.gov/vuln/detail/CVE-2026-2900) | Low | Merge request approval rules (EE) - GraphQL mutations & authorization policies | [`c51a8c23`](https://gitlab.com/gitlab-org/gitlab/-/commit/c51a8c23ccbd2a51f56a9e873ccbf5a28e10b87e) | | 2026-05-13 | [CVE-2026-6883](https://nvd.nist.gov/vuln/detail/CVE-2026-6883) | Low | Security Orchestration Policies / Merge request approval (scan result) policies (GitLab EE) | [`a2087f5e`](https://gitlab.com/gitlab-org/gitlab/-/commit/a2087f5e6f413cc0a438746bfaef5e653fb2f988) | | 2026-07-07 | [CVE-2026-13151](https://nvd.nist.gov/vuln/detail/CVE-2026-13151) | Low | EE merge-request approval rules / approval policies authorization (ApprovalProjectRulePolicy, MergeRequests::ApprovalRulePolicy) | [`9499577d`](https://gitlab.com/gitlab-org/gitlab/-/commit/9499577ded9582a140a216b4534cd72820064cf9) | ### G39. A duplicated/reimplemented authorization check drifted from the authoritative one *recurring, 4 findings* **Root cause.** A security predicate was reimplemented as a hand-rolled query or parallel copy (KAS membership INNER JOIN, todo membership check, Banzai issue-read duplicate, SAML password-to-approve) that diverged from the canonical policy, dropping a predicate (members.state=ACTIVE, namespace ban, IP restriction, per-MR password) the authoritative path enforces. **Prevent.** No authorization logic is duplicated outside the canonical policy; a keep-in-sync copy is replaced by a direct policy call, enforced by review/lint. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2024-05-07 | [CVE-2024-1539](https://nvd.nist.gov/vuln/detail/CVE-2024-1539) | Medium | Todos API / to-do access filtering (team_planning) | [`937b10cc`](https://gitlab.com/gitlab-org/gitlab/-/commit/937b10cc4cebcc10b870623a547ca093cb4757dc) | | 2024-08-06 | [CVE-2024-4784](https://nvd.nist.gov/vuln/detail/CVE-2024-4784) | Medium | Merge request approvals / Security & Compliance (merge request approval policies, EE ApprovalService) | [`42526d75`](https://gitlab.com/gitlab-org/gitlab/-/commit/42526d753dc6ea54beb7ed7e73a222befbe3ee00) | | 2024-11-12 | [CVE-2024-9693](https://nvd.nist.gov/vuln/detail/CVE-2024-9693) | High | Kubernetes agent (KAS) user-access proxy authorization | [`58ddb619`](https://gitlab.com/gitlab-org/gitlab/-/commit/58ddb6195652c2d04fb90db5b53889273090c18c) | | 2025-05-07 | [CVE-2025-1278](https://nvd.nist.gov/vuln/detail/CVE-2025-1278) | Medium | Banzai markdown reference redactor / issue read-authorization (app/models Ability + IssuePolicy) | [`542b1da9`](https://gitlab.com/gitlab-org/gitlab/-/commit/542b1da9d89d43450d87752ff09658140d4a3b71) | ### G40. Lossy diff-path UTF-8 encoding collapses distinct paths *recurring, 4 findings* **Root cause.** Gitlab::Git::Diff derives the diff-file key by lossily force-encoding the raw path to UTF-8 (EncodingHelper#encode!), and consumers identify files by that encoded path (SHA1) with no collision detection, so two byte-distinct paths collapse to one, hiding a file from diff review / snippet listing. **Prevent.** Diff/snippet file identity must be collision-checked against the raw path; a fixture asserts two distinct raw paths never collapse. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2024-08-06 | [CVE-2024-6329](https://nvd.nist.gov/vuln/detail/CVE-2024-6329) | Medium | code-review / merge-request diff rendering (Gitlab::Git::Diff, DiffsMetadataEntity) | [`ba336000`](https://gitlab.com/gitlab-org/gitlab/-/commit/ba3360000e58eb8a0633cfddf94c0743b009b948) | | 2026-02-09 | [CVE-2026-1094](https://nvd.nist.gov/vuln/detail/CVE-2026-1094) | Medium | Merge request / commit diff rendering — Gitlab::Git::Diff path encoding + the Rapid Diffs viewer engine (rolled out as the new default MR/commit changes UI in 18.8). | not publicly recorded | | 2026-06-10 | [CVE-2026-6976](https://nvd.nist.gov/vuln/detail/CVE-2026-6976) | Low | Merge request diffs / repository diff encoding (lib/gitlab/git/diff.rb, lib/gitlab/gitaly_client/commit_service.rb, lib/gitlab/encoding_helper.rb) | [`6de8d550`](https://gitlab.com/gitlab-org/gitlab/-/commit/6de8d55065f05638901f8506b4c7c124b4c930a7) | | 2026-06-23 | [CVE-2026-1606](https://nvd.nist.gov/vuln/detail/CVE-2026-1606) | Medium | GraphQL Snippets blobs resolver / snippet repository file listing | [`473c033b`](https://gitlab.com/gitlab-org/gitlab/-/commit/473c033be7b58460aa0fabeaf44695b5c6e3b5b3) | ### G41. No bound on numeric magnitude of parsed values *recurring, 4 findings* **Root cause.** Attacker input is converted to numbers via Ruby core (String#to_i, Oj/BigDecimal, JSON parse) with no digit/magnitude cap, and CRuby decimal-to-Bignum and scientific-notation-to-BigDecimal expansion are super-linear, so a long numeric literal forces expensive allocation/CPU. **Prevent.** Parsed numbers exceeding a digit/bit ceiling are rejected before conversion; validator + conversion-helper tests. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2025-03-26 | [CVE-2024-10307](https://nvd.nist.gov/vuln/detail/CVE-2024-10307) | Medium | ci-terraform-reports-parser | [`ef8fda85`](https://gitlab.com/gitlab-org/gitlab/-/commit/ef8fda85fb9386476224169a22dd12c962dbf802) | | 2025-09-25 | [CVE-2025-10868](https://nvd.nist.gov/vuln/detail/CVE-2025-10868) | Low | Ruby core string/number conversion (global initializer) — cross-cutting mitigation, not a single controller | [`11c051e3`](https://gitlab.com/gitlab-org/gitlab/-/commit/11c051e364d1) | | 2026-03-24 | [CVE-2025-13078](https://nvd.nist.gov/vuln/detail/CVE-2025-13078) | Medium | Webhooks (custom webhook template rendering / JSON payload serialization) | [`204a87bb`](https://gitlab.com/gitlab-org/gitlab/-/commit/204a87bbcc75c452b60307137a594bf4117ecdbe) | | 2026-03-24 | [CVE-2026-3988](https://nvd.nist.gov/vuln/detail/CVE-2026-3988) | High | GraphQL request processing / JSON input validation (lib/gitlab/json StreamValidator + Gitlab::Graphql::Variables) | [`b7baee17`](https://gitlab.com/gitlab-org/gitlab/-/commit/b7baee17f1986166e7c0fcbda978825c0b3f9a66) | ### G42. Sandbox iframes derive webpack public path from an attacker-controlled URL param *recurring, 4 findings* **Root cause.** The Mermaid/Swagger sandbox bootstrap copies a URL query parameter (relativeRootPath) straight into __webpack_public_path__/gon.relative_url_root with a flawed or absent same-origin check, so an attacker host (via protocol-relative //host or backslash-host) becomes webpack chunk-loading base; the sandbox CSP is also derived from instance config and does not block inline scripts unconditionally. **Prevent.** The sandbox public-path must pass a strict isRootRelative check (backslash/protocol-relative rejected) and the sandbox endpoint always sets script-src without unsafe-inline; unit tests per bypass. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2025-12-10 | [CVE-2025-12029](https://nvd.nist.gov/vuln/detail/CVE-2025-12029) | High | Swagger UI / OpenAPI blob viewer sandbox (frontend asset bootstrap) | [`990558a0`](https://gitlab.com/gitlab-org/gitlab/-/commit/990558a0b288a24446becf198db4c48027b4bbfe) | | 2026-02-24 | [CVE-2026-0752](https://nvd.nist.gov/vuln/detail/CVE-2026-0752) | High | Frontend Mermaid diagram sandbox iframe (app/assets/javascripts/lib/mermaid.js) served by SandboxController#mermaid | [`bddf3cbd`](https://gitlab.com/gitlab-org/gitlab/-/commit/bddf3cbd7e3ec18e7e09039623e1097c546ece32) | | 2026-03-24 | [CVE-2026-2973](https://nvd.nist.gov/vuln/detail/CVE-2026-2973) | Medium | Mermaid diagram sandbox (SandboxController#mermaid + Content-Security-Policy) | [`32af9bb9`](https://gitlab.com/gitlab-org/gitlab/-/commit/32af9bb93e39684370fe9ac0f0d9971497aab314) | | 2026-04-21 | [CVE-2026-3254](https://nvd.nist.gov/vuln/detail/CVE-2026-3254) | Low | Frontend Markdown rendering - Mermaid diagram sandbox (client-side) | [`236feb98`](https://gitlab.com/gitlab-org/gitlab/-/commit/236feb98ddcb89ca3dba4489d6ba4de1cacd3c1c) | ### G43. OAuth/device consent buttons are focus/fragment-targetable with no gesture gate *recurring, 4 findings* **Root cause.** Doorkeeper OAuth/device consent pages render the Authorize/confirm control with a static framework-default id and no deliberate-gesture requirement, so a URL fragment focuses it and Enter/Space (or double-clickjacking bypassing X-Frame-Options) activates it. **Prevent.** Consent submit controls carry no guessable id and demand an explicit gesture; tests assert fragment-focus/keyboard cannot one-shot authorize. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2024-06-25 | [CVE-2024-2177](https://nvd.nist.gov/vuln/detail/CVE-2024-2177) | Medium | OAuth authorization (Doorkeeper consent page) | [`50734997`](https://gitlab.com/gitlab-org/gitlab/-/commit/5073499734aa260dc96a6329ff913ae72a3e2e62) | | 2024-11-12 | [CVE-2024-7404](https://nvd.nist.gov/vuln/detail/CVE-2024-7404) | Medium | OAuth 2.0 Device Authorization Grant flow (Doorkeeper) - device authorization consent pages | [`ddf06283`](https://gitlab.com/gitlab-org/gitlab/-/commit/ddf06283c33c5b7828843421812353dfaeee2551) | | 2025-04-09 | [CVE-2025-0362](https://nvd.nist.gov/vuln/detail/CVE-2025-0362) | Medium | OAuth / Doorkeeper authorization consent page (Oauth::AuthorizationsController#new -> app/views/doorkeeper/authorizations/new.html.haml) | [`e02da7cb`](https://gitlab.com/gitlab-org/gitlab/-/commit/e02da7cb01b2bda6eaedbf5e9d50133d39587e48) | | 2025-05-07 | [CVE-2025-0549](https://nvd.nist.gov/vuln/detail/CVE-2025-0549) | Medium | OAuth 2.0 Device Authorization Grant (RFC 8628) authorization UI (Doorkeeper device flow) | [`74620473`](https://gitlab.com/gitlab-org/gitlab/-/commit/74620473c5a7d686aafd7792eb0574d9a80d75db) | ### G44. User-controlled value used as a path segment without normalization/validation *recurring, 4 findings* **Root cause.** Attacker-controlled values (security report version, branch name, Harbor name/digest, devfile) are placed into a filesystem/URL path or fed to a native parser without validating format or normalizing traversal, letting ../ or crafted segments escape the intended location. **Prevent.** Any user value used as a path segment is first passed through a validation/encoding helper; lint on File.join/URL templates with raw params. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2024-01-24 | [CVE-2024-0402](https://nvd.nist.gov/vuln/detail/CVE-2024-0402) | Critical | Remote Development / Workspaces (EE) — devfile parsing pipeline in the workspace-create flow (ee/lib/remote_development/workspaces/create/) | [`1e163bb2`](https://gitlab.com/gitlab-org/gitlab/-/commit/1e163bb209f53e841a2cd5ad83177e286c9977bd) | | 2024-04-24 | [CVE-2024-2434](https://nvd.nist.gov/vuln/detail/CVE-2024-2434) | High | CI security report parsing / schema validation (Gitlab::Ci::Parsers::Security) | [`9aefb64d`](https://gitlab.com/gitlab-org/gitlab/-/commit/9aefb64d69d84e19e9e9be73d9f987944b27aca5) | | 2024-12-10 | [CVE-2024-8647](https://nvd.nist.gov/vuln/detail/CVE-2024-8647) | Medium | Harbor integration container registry (packages_and_registries) — serializer entities + Vue harbor_registry frontend | [`85dcd3a3`](https://gitlab.com/gitlab-org/gitlab/-/commit/85dcd3a30d82b2551f4abbfc8ac3d612caff4252) | | 2025-11-11 | [CVE-2025-11990](https://nvd.nist.gov/vuln/detail/CVE-2025-11990) | Low | security-orchestration-policy-editor (frontend) / Api client helper | [`205d7dcc`](https://gitlab.com/gitlab-org/gitlab/-/commit/205d7dcc7027e80a0e6796a673884f77792199ef) | ### G45. Credential masking by pattern-matching misses real credential shapes *recurring, 4 findings* **Root cause.** Gitlab::UrlSanitizer / display normalization mask credentials purely by regex (SCP-exclusion lookahead, URI_REGEXP, sentinel gsub, unanchored www strip) with no knowledge of the actual configured secret, so a port+path authority, unencoded userinfo, unencoded sentinel, or crafted host defeats masking. **Prevent.** Credential masking uses the stored secret value where available and anchored patterns otherwise; regression tests for port+path, unencoded userinfo, sentinel. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2024-09-11 | [CVE-2024-5435](https://nvd.nist.gov/vuln/detail/CVE-2024-5435) | Medium | Repository mirroring / Gitlab::UrlSanitizer credential masking (lib/gitlab/url_sanitizer.rb) | [`2df401b9`](https://gitlab.com/gitlab-org/gitlab/-/commit/2df401b90febce44425fc03bbb1ba9eceef84a88) | | 2024-09-11 | [CVE-2024-6446](https://nvd.nist.gov/vuln/detail/CVE-2024-6446) | Low | OAuth / Doorkeeper authorization consent screen (app/views/doorkeeper/authorizations/new.html.haml) | [`97211a42`](https://gitlab.com/gitlab-org/gitlab/-/commit/97211a42ba751d3b7e24d763dd18ad99abaae989) | | 2025-03-11 | [CVE-2024-12380](https://nvd.nist.gov/vuln/detail/CVE-2024-12380) | Medium | Repository mirroring (push mirror RemoteMirror / pull mirror ProjectImportState) error-message credential sanitization | [`08ae6443`](https://gitlab.com/gitlab-org/gitlab/-/commit/08ae64432f8ea3a57d4f1f731fed435a34087f76) | | 2026-03-10 | [CVE-2025-12697](https://nvd.nist.gov/vuln/detail/CVE-2025-12697) | Low | Integrations / Datadog webhook integration (app/models/integrations) | [`aa3eed96`](https://gitlab.com/gitlab-org/gitlab/-/commit/aa3eed96afc1d6e3fbcf9ba8bd8e1e42807c73b1) | ### G46. Derived/duplicated state not re-derived when its source changes *recurring, 4 findings* **Root cause.** A dependent attribute copied from a source (Maven/mirror upstream credentials tied to a URL, project-bot external flag, OrganizationUser owner grant mirroring users.admin) is coupled to the source only on the create/promote path, so mutating the source (URL/host change, token rotation, clearing admin) leaves the stale derived value in force. **Prevent.** Any derived security attribute is recomputed/invalidated on source mutation; tests assert URL/host/admin changes clear the dependent secret/grant/flag. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2024-09-24 | [CVE-2024-4278](https://nvd.nist.gov/vuln/detail/CVE-2024-4278) | Medium | Dependency Proxy for Packages (Maven external registry) — EE package registry | [`2e3b0d70`](https://gitlab.com/gitlab-org/gitlab/-/commit/2e3b0d702470cb6080a8cd329d9f97f27205e3e8) | | 2025-03-26 | [CVE-2024-12619](https://nvd.nist.gov/vuln/detail/CVE-2024-12619) | Medium | Project/Group access tokens (resource access token rotation) - PersonalAccessTokens::RotateService base service | [`138f3c4b`](https://gitlab.com/gitlab-org/gitlab/-/commit/138f3c4b1549314e4286155c92def410b4c4e118) | | 2025-03-26 | [CVE-2025-2242](https://nvd.nist.gov/vuln/detail/CVE-2025-2242) | High | Organizations / user admin status <-> default-organization access level synchronization | [`3837a1ad`](https://gitlab.com/gitlab-org/gitlab/-/commit/3837a1ad2486f34a2d3376bbea1382b9ff9fa980) | | 2026-07-07 | [CVE-2026-11827](https://nvd.nist.gov/vuln/detail/CVE-2026-11827) | Medium | EE repository pull mirroring / project import credentials (ProjectImportData) | [`bb855219`](https://gitlab.com/gitlab-org/gitlab/-/commit/bb855219cdd0f92b2577df3c11d9d7536a88ded7) | ### G47. Confidentiality-skip optimization diverges from the assignee row filter *recurring, 3 findings* **Root cause.** IssuesFinder skips per-issue confidentiality authorization when it believes the query is self-scoped, deciding that via includes_user?/by_project_confidentiality logic that diverges from how the assignee/project filter actually scopes rows, so confidential issues leak. **Prevent.** The confidentiality-skip condition and the row filter must be computed from one shared predicate; a test asserts they cannot disagree. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2024-05-07 | [CVE-2024-3976](https://nvd.nist.gov/vuln/detail/CVE-2024-3976) | Medium | Issues search/list — IssuesFinder confidentiality filtering (app/finders/issues) | [`0da5bb1a`](https://gitlab.com/gitlab-org/gitlab/-/commit/0da5bb1a47564cec8c7aec4fa98c6706eedea195) | | 2025-04-09 | [CVE-2024-11129](https://nvd.nist.gov/vuln/detail/CVE-2024-11129) | Medium | Advanced (Elasticsearch) global/group search - confidential issue filtering (EE) | [`84a94c7a`](https://gitlab.com/gitlab-org/gitlab/-/commit/84a94c7a024ff295241bbf659812cd4a71bd2639) | | 2026-04-07 | [CVE-2026-2104](https://nvd.nist.gov/vuln/detail/CVE-2026-2104) | Medium | Issues finder / issue confidentiality authorization (assignee filtering, used by issue list + CSV export) | [`0512e17f`](https://gitlab.com/gitlab-org/gitlab/-/commit/0512e17f0e396188ecf7aa3b3835d80572c7df92) | ### G48. Non-human git access paths bypass the policy-layer authorization *recurring, 3 findings* **Root cause.** Deploy-key/LFS/Geo git access paths bypass ProjectPolicy checks that human pushes route through: archived read-only is enforced only via push_code (skipped by deploy-key path), the LFS HMAC token carries no project scope, and Geo secondary local-serve-vs-redirect races on an inconsistent freshness source. **Prevent.** GitAccess enforces archived/project-scope/freshness consistently for deploy-key/LFS/Geo; token validation requires the issuing project; tests per path. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2024-08-06 | [CVE-2024-3035](https://nvd.nist.gov/vuln/detail/CVE-2024-3035) | Medium | Git/LFS authentication (Gitlab::Auth / Gitlab::LfsToken) | [`de2022b4`](https://gitlab.com/gitlab-org/gitlab/-/commit/de2022b4a5ee5a708454626bcadce1c50467c812) | | 2024-10-09 | [CVE-2024-9623](https://nvd.nist.gov/vuln/detail/CVE-2024-9623) | Medium | Git access authorization (Gitlab::GitAccess push-access checks) for repository push over SSH/HTTP | [`7950fe58`](https://gitlab.com/gitlab-org/gitlab/-/commit/7950fe587ec01257909ee1c6f4035e4477b97c6a) | | 2025-06-11 | [CVE-2024-9512](https://nvd.nist.gov/vuln/detail/CVE-2024-9512) | Medium | Geo replication - Git access / repository redirection (EE) | [`54bdbd46`](https://gitlab.com/gitlab-org/gitlab/-/commit/54bdbd4638f4d92af0eb9b93b5d379ef861d7b2b) | ### G49. CI config/action authorized without checking write authority over the ref *recurring, 3 findings* **Root cause.** CI operations that act as pipeline config for a ref (CI Lint protected-variable context from an attacker sha, manual-variable job retry, DAST profile targeting a branch) authorize only a coarse create/read ability and never check the actor may push/write the protected ref, so protected-variable/pipeline context is obtained without ref authority. **Prevent.** Any operation that gains protected-ref/variable context checks push authorization for that ref; tests per path. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2024-09-11 | [CVE-2024-2743](https://nvd.nist.gov/vuln/detail/CVE-2024-2743) | Medium | EE Dynamic Application Security Testing (DAST) on-demand scans / AppSec Dast profiles | [`e663019b`](https://gitlab.com/gitlab-org/gitlab/-/commit/e663019be4168b0f42cf895be213d9d9fef06cfc) | | 2025-01-22 | [CVE-2024-11931](https://nvd.nist.gov/vuln/detail/CVE-2024-11931) | Medium | CI/CD pipeline composition — CI Lint / YAML config validation | [`cea3d30e`](https://gitlab.com/gitlab-org/gitlab/-/commit/cea3d30eca2ebb9aedd749a4f43f98e328eef350) | | 2026-02-24 | [CVE-2025-14103](https://nvd.nist.gov/vuln/detail/CVE-2025-14103) | Medium | ci/pipelines - job retry service (Ci::RetryJobService) and JobRetry GraphQL mutation | [`48ddccc1`](https://gitlab.com/gitlab-org/gitlab/-/commit/48ddccc100d6b99442d6fafe51edf7ff0c707742) | ### G50. Quick-action execution not bound to the acting request/actor/scope *recurring, 3 findings* **Root cause.** Quick actions are re-run from stored descriptions (not the current edit), treat promotion as creation (create_* held by non-members), and verify only the user-level ability without inspecting the credential OAuth scope, so privileged commands execute under insufficient authorization. **Prevent.** Quick-action execution authorizes the specific target-modify ability + token scope on freshly-authored commands only; tests per bypass. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2024-06-25 | [CVE-2024-4011](https://nvd.nist.gov/vuln/detail/CVE-2024-4011) | Low | Quick actions / Work Items (OKR) — promote_to command | [`ff425064`](https://gitlab.com/gitlab-org/gitlab/-/commit/ff425064c3d22341d520fff8abf829a812c5c14f) | | 2024-07-09 | [CVE-2024-6385](https://nvd.nist.gov/vuln/detail/CVE-2024-6385) | Critical | Quick actions interpretation on issuables/notes (app/services/quick_actions, IssuableBaseService, Notes::QuickActionsService) | [`3d20fd45`](https://gitlab.com/gitlab-org/gitlab/-/commit/3d20fd45ec2b24ff02a06eea0ef1558f522a211d) | | 2025-10-21 | [CVE-2025-11989](https://nvd.nist.gov/vuln/detail/CVE-2025-11989) | Low | Quick actions / issuable & note services (EE); OAuth token scope authorization | [`e3400bb1`](https://gitlab.com/gitlab-org/gitlab/-/commit/e3400bb1e2194c379d4ac443278c4c3157b9049c) | ### G51. LLM consumes attacker content; output/tool actions treated as trusted *recurring, 3 findings* **Root cause.** Duo features embed attacker-controllable content (comments, MR context) into the model prompt or auto-apply model output (patch->CI, links, tool-resolved resource reads authorized against the reviewer) trusting the model output and that what a human sees equals what the model reads, so prompt injection triggers privileged actions/reads. **Prevent.** Model-triggered writes require human review; tool reads carry the confidentiality context of the injected reference; untrusted prompt content is sanitized; eval tests. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2024-09-24 | [CVE-2024-4099](https://nvd.nist.gov/vuln/detail/CVE-2024-4099) | Low | GitLab Duo / AI - SummarizeComments chain tool (ee/lib/gitlab/llm/chain/tools/summarize_comments) | [`a0ff56cc`](https://gitlab.com/gitlab-org/gitlab/-/commit/a0ff56cc58330b1b3e6ad133de203f0655a6e227) | | 2025-02-11 | [CVE-2024-3303](https://nvd.nist.gov/vuln/detail/CVE-2024-3303) | Medium | GitLab Duo Chat (EE) — ReAct executor final-answer rendering (ee/lib/gitlab/duo/chat) | [`babc0548`](https://gitlab.com/gitlab-org/gitlab/-/commit/babc054870124dc9faad58f9580ca5cd1d48d9c4) | | 2025-11-11 | [CVE-2025-6945](https://nvd.nist.gov/vuln/detail/CVE-2025-6945) | Low | GitLab Duo (LLM chain) - Duo Code Review / merge-request chat authorization (ee/lib/gitlab/llm/chain) | [`44411794`](https://gitlab.com/gitlab-org/gitlab/-/commit/4441179483cc) | ### G52. Identity linking / SAML approval trusts client-supplied provider params & is CSRF-reachable *recurring, 3 findings* **Root cause.** OmniAuth JWT/SAML identity-link and SAML-approval flows read the linking provider/extern_uid or honor the post-login redirect from params/redirect URL rather than the authenticated callback session, and are GET/redirect-reachable state changes outside Rails CSRF protection. **Prevent.** Identity-link/approval params come from the authenticated session, not request params; state-changing callbacks carry CSRF/consent; tests per flow. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2024-05-07 | [CVE-2024-1211](https://nvd.nist.gov/vuln/detail/CVE-2024-1211) | Medium | OmniAuth authentication / identity linking (JWT provider) | [`e889c09b`](https://gitlab.com/gitlab-org/gitlab/-/commit/e889c09bd4bd3897badb73d79231f183881a20f4) | | 2024-05-07 | [CVE-2024-4597](https://nvd.nist.gov/vuln/detail/CVE-2024-4597) | Medium | SAML SSO (OmniAuth callbacks) / Merge Request SAML approvals (EE) | [`04e8a5e1`](https://gitlab.com/gitlab-org/gitlab/-/commit/04e8a5e1f3ac2c678e30f7a14aafdea580272ab1) | | 2024-09-11 | [CVE-2024-8754](https://nvd.nist.gov/vuln/detail/CVE-2024-8754) | Medium | Authentication / SSO identity linking (OmniAuth JWT identity linker + UserSettings::IdentitiesController) | [`e2d18389`](https://gitlab.com/gitlab-org/gitlab/-/commit/e2d183895fdf) | ### G53. Legacy blob/code-nav viewer assigns attacker strings to innerHTML *recurring, 3 findings* **Root cause.** The legacy simple blob viewer injects server viewer HTML verbatim and the code-navigation decorator re-inserts highlighted blob textContent via element.innerHTML, with the no-unsanitized ESLint guard suppressed and no viewer-type gate, so rendered-HTML viewers reprocess untrusted source through an HTML sink. **Prevent.** Ban innerHTML in blob/code-nav modules (no eslint-disable of no-unsanitized); code-nav emits only for the plain-source viewer. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2025-07-09 | [CVE-2025-6948](https://nvd.nist.gov/vuln/detail/CVE-2025-6948) | High | Repository blob viewer / code navigation (frontend, Vue) | [`847f350f`](https://gitlab.com/gitlab-org/gitlab/-/commit/847f350fa8f7) | | 2025-07-22 | [CVE-2025-4700](https://nvd.nist.gov/vuln/detail/CVE-2025-4700) | High | Repository blob view frontend (app/assets/javascripts/blob/viewer legacy simple/auxiliary blob viewer + app/assets/javascripts/code_navigation code-nav DOM decoration) | [`8370acfa`](https://gitlab.com/gitlab-org/gitlab/-/commit/8370acfaf1d203a7227765309492498c93806a52) | | 2025-08-12 | [CVE-2025-7734](https://nvd.nist.gov/vuln/detail/CVE-2025-7734) | High | Repository blob viewing / file rendering frontend (legacy simple blob viewer + code navigation DOM builder) | [`26b86664`](https://gitlab.com/gitlab-org/gitlab/-/commit/26b86664fcb998f19d4e390ad4c4300bfd2cf910) | ### G54. Post-import ref cleanup uses an incomplete denylist *recurring, 3 findings* **Root cause.** Post-import ref sanitization enumerates only some ref shapes (SHA-like branch refs) via a denylist regex instead of validating every imported ref name through GitRefValidator, so SHA-named tags or nested refs/heads segments survive import. **Prevent.** Import ref cleanup runs each ref through GitRefValidator; test covers tag + nested-ref cases. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2024-07-24 | [CVE-2024-0231](https://nvd.nist.gov/vuln/detail/CVE-2024-0231) | Low | Project repository import (post-import ref cleanup) | [`638447ec`](https://gitlab.com/gitlab-org/gitlab/-/commit/638447ecfe01cd0c35713ec7a29350f6fde021df) | | 2024-08-20 | [CVE-2024-6502](https://nvd.nist.gov/vuln/detail/CVE-2024-6502) | Medium | source-code-management / git ref-change processing (Releases <-> Git tags) | [`8212ba9b`](https://gitlab.com/gitlab-org/gitlab/-/commit/8212ba9bb6cde25f784e1fb9742dfa7a575a390d) | | 2026-03-10 | [CVE-2026-1230](https://nvd.nist.gov/vuln/detail/CVE-2026-1230) | Medium | Repository model / project import — branch/tag ref-name sanitization (app/models/repository.rb#remove_prohibited_refs, invoked from Project#after_import) | [`8f9ffe18`](https://gitlab.com/gitlab-org/gitlab/-/commit/8f9ffe18f008fd9095c565f19c79cc425b057b57) | ### G55. Integration config fields interpolated into shell/query snippets *recurring, 3 findings* **Root cause.** Integration model fields (Google Cloud IAM identifiers, Harbor project_name, Product Analytics funnel steps) are validated only for presence and then interpolated verbatim into unescaped shell command snippets / copy-paste scripts / single-quoted Cube queries. **Prevent.** Every integration field that reaches a shell/query template carries a format validation restricting it to a safe charset at the model boundary; validated by model spec. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2024-09-11 | [CVE-2024-8640](https://nvd.nist.gov/vuln/detail/CVE-2024-8640) | High | Product Analytics (EE) — funnel configuration / Cube (configurator) integration | [`44533646`](https://gitlab.com/gitlab-org/gitlab/-/commit/4453364640da5b3a422af92bb0fbc9356b26f195) | | 2025-03-11 | [CVE-2024-8402](https://nvd.nist.gov/vuln/detail/CVE-2024-8402) | Low | Integrations :: Google Cloud IAM (Workload Identity Federation) integration | [`649d3dea`](https://gitlab.com/gitlab-org/gitlab/-/commit/649d3dea98eb12d185791d022f04c39eb4ff4fd4) | | 2025-03-26 | [CVE-2024-9773](https://nvd.nist.gov/vuln/detail/CVE-2024-9773) | Low | Harbor container registry integration (Integrations::Harbor model + packages_and_registries/harbor_registry frontend) | [`d71bb82d`](https://gitlab.com/gitlab-org/gitlab/-/commit/d71bb82df57e812e557165c4650349b81eb2d807) | ### G56. Internal-note confidentiality enforced only at UI/policy, not at serialization *recurring, 3 findings* **Root cause.** Internal-note visibility is enforced at the UI/policy layer, but note-serializing paths (new-review mailer, create-issue-to-resolve BuildService, Duo Code Review context) assemble content from raw Note bodies with no per-recipient :read_internal_note filter, so internal notes reach unauthorized recipients/LLM. **Prevent.** No path serializes note content without applying the per-recipient internal-note visibility filter; tests per consumer (mailer/build/LLM). | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2024-12-10 | [CVE-2024-8650](https://nvd.nist.gov/vuln/detail/CVE-2024-8650) | Medium | Issues / Merge Request discussion resolution (Issues::BuildService + ResolveDiscussions concern) | [`fa33b0d8`](https://gitlab.com/gitlab-org/gitlab/-/commit/fa33b0d8d6e80aed6f5c020b7240ddf59c7f94f0) | | 2025-03-11 | [CVE-2025-0652](https://nvd.nist.gov/vuln/detail/CVE-2025-0652) | Medium | Merge request review notifications (ActionMailer) — new-review email path | [`1ccf3302`](https://gitlab.com/gitlab-org/gitlab/-/commit/1ccf3302c55f26b50772709588d1e37ddfb10438) | | 2025-07-22 | [CVE-2025-4976](https://nvd.nist.gov/vuln/detail/CVE-2025-4976) | Medium | GitLab Duo Code Review / AI chat merge-request context serialization (EE, ee/app/finders/ai + ee/lib/gitlab/llm) | [`27082637`](https://gitlab.com/gitlab-org/gitlab/-/commit/27082637f5a11b44d9eef9062cdd8873f6bb2e42) | ### G57. Decoded path/fragment reflected into a redirect without normalization *recurring, 3 findings* **Root cause.** Jira DVCS restore_full_path and OmniAuth redirect-fragment handling reflect a decoded path/fragment into a redirect target while defending only against interior double-slashes / trusting the fragment as inert, so a leading single slash yields a protocol-relative redirect or reserved chars alter the target. **Prevent.** Values reflected into redirects pass a strict same-site validation (no leading //, no reserved chars); tests per bypass. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2024-09-11 | [CVE-2024-4283](https://nvd.nist.gov/vuln/detail/CVE-2024-4283) | Medium | Jira DVCS integration redirect routing (lib/gitlab/jira/dvcs.rb + config/routes/project.rb `/-/jira/*namespace_id/:project_id` redirect routes) | [`4ece8de8`](https://gitlab.com/gitlab-org/gitlab/-/commit/4ece8de829be74e915c61ac0ec8ab2714fcd83f5) | | 2024-09-11 | [CVE-2024-4612](https://nvd.nist.gov/vuln/detail/CVE-2024-4612) | Medium | Jira DVCS integration route redirect (lib/gitlab/jira/dvcs.rb, config/routes/project.rb) | [`4ece8de8`](https://gitlab.com/gitlab-org/gitlab/-/commit/4ece8de829be74e915c61ac0ec8ab2714fcd83f5) | | 2024-12-10 | [CVE-2024-9387](https://nvd.nist.gov/vuln/detail/CVE-2024-9387) | Medium | Authentication / OmniAuth OAuth callback (app/controllers/omniauth_callbacks_controller.rb) | [`0f9bdea0`](https://gitlab.com/gitlab-org/gitlab/-/commit/0f9bdea0c2844cee90181c3ce4c2f54490cb9962) | ### G58. MR approvals/CODEOWNERS validity coupled to a diff that goes stale *recurring, 2 findings* **Root cause.** Approval and CODEOWNERS-path detection are derived from a merge-ref/on-push diff comparison that no-ops or cannot regenerate for closed/non-mergeable MRs, so reopening or a stale merge_head_diff carries forward unverified approvals / misses required approvers. **Prevent.** Approval validity is bound to a fresh diff; reopening/retargeting invalidates approvals; regression tests for closed/reopened MRs. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2024-02-20 | [CVE-2024-0410](https://nvd.nist.gov/vuln/detail/CVE-2024-0410) | High | EE CODEOWNERS approval enforcement (Gitlab::CodeOwners / MergeRequests::SyncCodeOwnerApprovalRules) | [`7457a159`](https://gitlab.com/gitlab-org/gitlab/-/commit/7457a15973e913719461c0630d27c34b1dfae368) | | 2024-03-06 | [CVE-2024-0199](https://nvd.nist.gov/vuln/detail/CVE-2024-0199) | High | merge_requests / approvals (CODEOWNERS approval enforcement) | [`4be38a72`](https://gitlab.com/gitlab-org/gitlab/-/commit/4be38a72793e54c0f7f653be0e2b744d22dc1e0e) | ### G59. Pages host resolution conflates record existence with current ownership *recurring, 2 findings* **Root cause.** GitLab Pages virtual-host resolution serves a domain by checking only that a record/deployment exists (not that the PagesDomain is currently enabled/verified) and overloads one DNS host key across two namespaces with no cross-uniqueness, so a stale/duplicate host is served. **Prevent.** Pages serving requires a currently-verified domain and a host that maps to at most one namespace; tests for stale/duplicate hosts. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2024-07-09 | [CVE-2024-5528](https://nvd.nist.gov/vuln/detail/CVE-2024-5528) | Low | GitLab Pages custom-domain virtual host resolution (lib/gitlab/pages/virtual_host_finder.rb via internal Pages API) | [`08a5faf3`](https://gitlab.com/gitlab-org/gitlab/-/commit/08a5faf3c92d34407a96b03d6a44c12db00ee1f2) | | 2024-10-09 | [CVE-2024-9633](https://nvd.nist.gov/vuln/detail/CVE-2024-9633) | Low | GitLab Pages / Namespaces (top-level group & user creation vs Pages unique-domain resolution) | [`fced55b8`](https://gitlab.com/gitlab-org/gitlab/-/commit/fced55b8da2c99ff87eeb111a03ec9bd46a5964a) | ### G60. Bot/service-account/OAuth auth branches skip the blocked-state check *recurring, 2 findings* **Root cause.** Bot users and service accounts are intentionally exempted from the standard login gate (which rejects blocked accounts) so automation keeps working, and both bypass branches omit an explicit blocked? check; a namespace-inheritable auth helper also handled only PATs, never validating OAuth tokens. **Prevent.** Every authentication branch (human, bot, service-account, PAT, OAuth) checks blocked state and validates the token; tests per branch. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2026-04-21 | [CVE-2026-6515](https://nvd.nist.gov/vuln/detail/CVE-2026-6515) | Medium | API authentication helpers / Virtual Registries (Maven) package API | [`ca9dd2b0`](https://gitlab.com/gitlab-org/gitlab/-/commit/ca9dd2b032a0523b90cb2ae2032e106e6d75d92d) | | 2026-05-26 | [CVE-2026-9807](https://nvd.nist.gov/vuln/detail/CVE-2026-9807) | Medium | Authentication / authorization (Gitlab::Auth git-client + sessionless request authentication for bot users) | [`3d678147`](https://gitlab.com/gitlab-org/gitlab/-/commit/3d678147a8014c6d0af53e0a73cb3b16b7865109) | ### G61. Identity binding keyed on a mutable/attacker-controllable extern_uid *recurring, 2 findings* **Root cause.** The (provider, extern_uid) identity key assumed to be immutable is set from a reassignable value (Bitbucket username) or is rewritable via the Provider Identity API, while login binds an assertion to an account solely by extern_uid lookup, so the account-binding key is attacker-controllable. **Prevent.** extern_uid used for account binding must originate from an immutable, provider-verified subject; rewriting it invalidates/re-verifies the identity; tests. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2024-04-24 | [CVE-2024-4024](https://nvd.nist.gov/vuln/detail/CVE-2024-4024) | High | authentication / OmniAuth OAuth2 sign-in (Bitbucket provider identity resolution) | [`4bff4d82`](https://gitlab.com/gitlab-org/gitlab/-/commit/4bff4d82fb045dfc1cce4ef08685c3b3aba2ca6e) | | 2026-06-10 | [CVE-2026-6552](https://nvd.nist.gov/vuln/detail/CVE-2026-6552) | High | Group SAML SSO identity management (EE) — Provider Identity API + group SAML login flow | [`d593d858`](https://gitlab.com/gitlab-org/gitlab/-/commit/d593d8585a31b52e5cc267c2c5faf02a652cf93c) | ### G62. SAML find_user override loses the base external-provider rule *recurring, 2 findings* **Root cause.** Gitlab::Auth::Saml::User fully overrides the base OAuth find_user without calling super, so it never consults external_providers config and derives the external flag solely from external_groups intersection, downgrading an admin-designated external user. **Prevent.** The SAML user builder derives external from the shared base rule (external_provider? + groups); a test asserts provider-external users stay external. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2025-01-08 | [CVE-2024-13041](https://nvd.nist.gov/vuln/detail/CVE-2024-13041) | Medium | SAML/OmniAuth authentication (Gitlab::Auth::Saml::User) - external-user classification on SSO login/provisioning | [`c2de306b`](https://gitlab.com/gitlab-org/gitlab/-/commit/c2de306ba30f5afda1e7a24afb94c8e7dc04cedb) | | 2025-02-11 | [CVE-2025-1540](https://nvd.nist.gov/vuln/detail/CVE-2025-1540) | Low | SAML omniauth authentication - external-user attribute provisioning (Gitlab::Auth::Saml::User) | [`c2de306b`](https://gitlab.com/gitlab-org/gitlab/-/commit/c2de306ba30f5afda1e7a24afb94c8e7dc04cedb) | ### G63. Outbound HTTP client does not neutralize CR/LF in header names/values *recurring, 2 findings* **Root cause.** The shared gitlab-http outbound client serializes caller-supplied header names/values verbatim, and webhook custom-header validation anchors its name pattern with ^/$ (line boundaries) rather than \A/\z, so embedded CR/LF/NUL survive and inject headers. **Prevent.** The shared HTTP client rejects control characters in headers centrally; schema anchors use \A/\z; regression tests per control char. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2025-09-09 | [CVE-2025-6454](https://nvd.nist.gov/vuln/detail/CVE-2025-6454) | High | webhooks (WebHook custom headers validation) | [`2fbae78a`](https://gitlab.com/gitlab-org/gitlab/-/commit/2fbae78a93122f5674e90ce40c2ed32961dfcaa5) | | 2026-03-10 | [CVE-2026-3848](https://nvd.nist.gov/vuln/detail/CVE-2026-3848) | Medium | gitlab-http gem (Gitlab::HTTP_V2 outbound client) used by import functionality | [`500930e7`](https://gitlab.com/gitlab-org/gitlab/-/commit/500930e7ebe4c262ecd9e450270402a211c4b8d7) | ### G64. Security-relevant UI choice presents a non-unique spoofable identifier *recurring, 2 findings* **Root cause.** Confidential-MR fork picker and move-issue confirmation label each destination by a user-settable, non-unique display name (name_with_namespace) instead of the unique full path, so an attacker-created look-alike is indistinguishable and a sensitive destination is chosen from a spoofable label. **Prevent.** Any security-relevant destination selector shows/keys on a unique identifier; component test asserts collision-safe labeling. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2025-05-21 | [CVE-2024-9163](https://nvd.nist.gov/vuln/detail/CVE-2024-9163) | Low | Merge Requests / confidential merge request fork picker (frontend Vue component) | [`cc8db4c4`](https://gitlab.com/gitlab-org/gitlab/-/commit/cc8db4c429b2b24affde59c8fdc9860711c38ab7) | | 2025-09-25 | [CVE-2025-5069](https://nvd.nist.gov/vuln/detail/CVE-2025-5069) | Low | Work items / issues — "Move issue" modal (frontend Vue component move_work_item_modal.vue) | [`d77b162a`](https://gitlab.com/gitlab-org/gitlab/-/commit/d77b162a62fe466aa96c8902564cdf06732d4e87) | ### G65. Token-authenticated endpoints create an interactive web session *recurring, 2 findings* **Root cause.** The Dependency Proxy Docker /v2 endpoints reuse Devise interactive sign_in on token-authenticated requests, emitting a full browser session cookie, mitigated only by a fragile path-regex StripCookies middleware that removes the cookie after the session is already created. **Prevent.** Token/registry endpoints must use a session-less authentication path; a test asserts no Set-Cookie on token-authenticated responses. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2024-09-11 | [CVE-2024-8641](https://nvd.nist.gov/vuln/detail/CVE-2024-8641) | Medium | Dependency Proxy / Container Registry auth (Groups::DependencyProxy, /v2 Docker registry endpoints) | [`8d01129b`](https://gitlab.com/gitlab-org/gitlab/-/commit/8d01129bb26a96e6ed56522bf4504759f0f56301) | | 2024-12-10 | [CVE-2024-12570](https://nvd.nist.gov/vuln/detail/CVE-2024-12570) | Medium | Dependency Proxy for Containers (Groups::DependencyProxy) — Docker Registry v2 auth endpoints | [`703bf4e4`](https://gitlab.com/gitlab-org/gitlab/-/commit/703bf4e4210bf18a02d58a9255d0abd758adf086) | ### G66. Unauthenticated signup scoped to a request-selected organization *singleton* **Root cause.** RegistrationsController builds the signup user with organization_id from Current.organization, which for an unauthenticated request is resolved from request-derived inputs, so signup can be steered into an arbitrary organization. **Prevent.** Unauthenticated signup must not accept a request-selected organization; a test asserts organization cannot be attacker-chosen. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2025-11-25 | [CVE-2025-12653](https://nvd.nist.gov/vuln/detail/CVE-2025-12653) | Medium | User registration / signup (Organizations membership) | [`007640e3`](https://gitlab.com/gitlab-org/gitlab/-/commit/007640e3198d98b76144b424e136a82b3f0e63e7) | ### G67. KAS gRPC handler processes malformed input without a defensive check *singleton* **Root cause.** A KAS gRPC handler processed an attacker-supplied request without validating exceptional/malformed input, driving the handler into an unhandled state that crashed the process. **Prevent.** gRPC handlers validate request shape and never panic on malformed input; fuzz/regression test. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2024-05-21 | [CVE-2024-5469](https://nvd.nist.gov/vuln/detail/CVE-2024-5469) | Low | KAS (GitLab Kubernetes Agent Server / gitlab-agent) gRPC API | not publicly recorded | ### G68. JiraConnect state-changing POST lacks CSRF protection *singleton* **Root cause.** Rails authenticity-token verification is globally skipped for JiraConnect controllers, and the legacy create action combined ambient session auth with an attacker-supplied non-QSH-bound Atlassian JWT, so a browser session cookie enabled a forged cross-site request. **Prevent.** State-changing JiraConnect actions are CSRF-protected and do not authorize via ambient session; test forged cross-site POST. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2026-05-13 | [CVE-2026-4527](https://nvd.nist.gov/vuln/detail/CVE-2026-4527) | Medium | GitLab for Jira Cloud app (JiraConnect) — subscriptions controller / Jira integration | [`5a1ea901`](https://gitlab.com/gitlab-org/gitlab/-/commit/5a1ea901b4838e8c5e9a3895b1f66453586a8091) | ### G69. npm package identity not reconciled between manifest and tarball *singleton* **Root cause.** npm publish carries package identity in the registry metadata and in the tarball package.json, and GitLab trusts the JSON manifest as the stored/displayed source of truth without ever reconciling it against the tarball, enabling content spoofing. **Prevent.** npm publish validates manifest-vs-tarball identity coherence; test with mismatched metadata. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2024-07-09 | [CVE-2024-6595](https://nvd.nist.gov/vuln/detail/CVE-2024-6595) | Low | npm package registry (Packages::Npm publish/processing) | [`14ce36e7`](https://gitlab.com/gitlab-org/gitlab/-/commit/14ce36e7045252dd74dc59a71a5acc348ceadf13) | ### G70. Chained gsub template substitution re-scans attacker-substituted content *singleton* **Root cause.** The Service Desk mailer substitute_template_replacements chains String#gsub calls in a fixed order, substituting the attacker-controlled %{NOTE_TEXT} before other placeholders, so the injected reply is re-scanned and re-substituted by later passes. **Prevent.** Template substitution is single-pass/non-re-entrant; a test asserts placeholder-bearing user content is not re-interpreted. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2026-06-10 | [CVE-2026-9694](https://nvd.nist.gov/vuln/detail/CVE-2026-9694) | Low | Service Desk email notifications (Emails::ServiceDesk mailer template rendering) | [`4c2b16fe`](https://gitlab.com/gitlab-org/gitlab/-/commit/4c2b16fe40ec7235e753a9a506c168e6ab85509d) | ### G71. Dev-only Storybook addon handles a live API token in the browser *singleton* **Root cause.** A development-only Storybook addon handled a real GitLab API token entirely client-side, seeding it from build-time env (embedding it in the bundle) and setting auth headers on an unauthenticated addon-channel message with no base-URL allowlist or origin check. **Prevent.** Dev tooling never embeds real tokens or sets auth headers client-side; build asserts no token in bundle. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2026-04-21 | [CVE-2026-5262](https://nvd.nist.gov/vuln/detail/CVE-2026-5262) | High | Storybook development environment / frontend tooling (gitlab_api_access Storybook addon) | [`108abfe2`](https://gitlab.com/gitlab-org/gitlab/-/commit/108abfe2569eca3ef50e418368906550579dc944) | ### G72. SQL three-valued logic bug in a todo-cleanup authorization query *singleton* **Root cause.** The confidential-issue todo-destroy query expressed keep-assignees as todos.user_id != issue_assignees.user_id over a LEFT JOIN, and SQL col != NULL evaluates to NULL (not TRUE), so unassigned issues preserved todos that should have been purged. **Prevent.** Authorization/cleanup queries over outer joins account for NULL; a test covers the unassigned-issue case. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2026-06-10 | [CVE-2026-3553](https://nvd.nist.gov/vuln/detail/CVE-2026-3553) | Low | Todos / confidential-issue authorization (app/services/todos/destroy) | [`a18eb364`](https://gitlab.com/gitlab-org/gitlab/-/commit/a18eb36481ce9bc93b68ea0171ee26c009084ee0) | ### G73. Inverted guard exposes the pprof profiling listener by default *singleton* **Root cause.** An inverted boolean returned early only when a profiling address was set, so the default empty address fell through to net.Listen on all interfaces on an ephemeral port and served the pprof handler. **Prevent.** The debug/pprof listener only binds when explicitly configured; a test asserts no listener on default config. | Fix date | ID | Severity | Area | Fix commit | |---|---|---|---|---| | 2025-04-09 | [CVE-2025-2469](https://nvd.nist.gov/vuln/detail/CVE-2025-2469) | Low | GitLab Workhorse (Go reverse proxy) - pprof profiling listener initialization in workhorse/cmd/gitlab-workhorse/main.go | [`753ddb68`](https://gitlab.com/gitlab-org/gitlab/-/commit/753ddb6865f23dc2403bb03bb902772c9c381218) |