AIKIDO-2026-996827
gitlab-ce is vulnerable to Code Injection
94
Critical Risk
This Affects:
gitlab-ceTL;DR
The GraphQL API accepts a crafted directive that is evaluated without adequate authorization. An unauthenticated attacker can use that directive to remotely modify or delete public projects and user data. The fix hardens GraphQL directive handling so this unauthenticated mutation path is no longer reachable.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
gitlab-ce is vulnerable to Code Injection in versions 18.2.0 - 18.11.9, 19.0.0 - 19.0.6, 19.1.0 - 19.1.4 and 19.2.0 - 19.2.2.
How to fix this
Upgrade the gitlab-ce library to the patch version.
Links
docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-4-released/gitlab.com/gitlab-org/gitlab/-/work_items/611377hackerone.com/reports/3926431
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant