GitLab · disclosed reports
Command and Code Injection
18 disclosed reports · $158,520 paid
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne.
Open GitLab on HackerOne- reports
- 18
- paid a bounty
- 11
Every one of the 18 is a mark on the map. Named now: 1 to 18, most upvoted first.
- Git flag injection - local file overwrite to remote code execution
- Local files could be overwritten in GitLab, leading to remote command execution
- RCE when removing metadata with ExifTool
- RCE via unsafe inline Kramdown options when rendering certain Wiki pages
- Remote Command Execution via Github import
- RCE via the DecompressedArchiveSizeValidator and Project BulkImports (behind feature flag)
- RCE via github import
- Git flag injection leading to file overwrite and potential remote code execution
- Path traversal, to RCE
- Send arbitrary PUT requests when user clicks on a link
- Git flag injection - Search API with scope 'blobs'
- GitLab-Runner on Windows `DOCKER_AUTH_CONFIG` container host Command Injection
- RCE via WikiCloth markdown rendering if the `rubyluabridge` gem is installed
- Command injection by overwriting authorized_keys file through GitLab import
- Vulnerability in project import leads to arbitrary command execution
- CSV injection in gitlab.com via issues export feature.
- Sending Arbitrary Requests through Jupyter Notebooks on gitlab.com and Self-Hosted GitLab Instances
- Arbitrary escape sequence injection in docker-machine from worker nodes
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.