AIKIDO-2026-665195

TL;DR

The pipeline and job tools interpolate the job_id argument into the GitLab API URL without URL-encoding or numeric validation, unlike project_id. Because URL parsing collapses ../ segments, a job_id containing dot-dot sequences escapes the intended jobs path and redirects the request to an arbitrary GitLab API endpoint. The request carries the operator's configured personal access token, so a caller who influences job_id can read the token owner's account, projects, and other resources beyond the job scope. The fix URL-encodes and validates job_id so user input cannot escape the intended path prefix.