GitLab · weakness class
Command and Code Injection
33 CVEs · 1 exploited
Every dot is a CVE in what this vendor ships; the named ones are the most at risk.
- exploited in the wild
- 1
- check available
- 2
- likely to be exploited
- 2
Every one of the 33 is a mark on the map. Named now: 1 to 26, most at risk first.
- GitLab CE/EE - Remote Code Execution
- GitLab CE/EE - Remote Code Execution
- GitLab CE/EE - GraphQL @gl_introduced Arbitrary Method Invocation
- A vulnerability in GitLab CE/EE affecting all versions from 11.3.4 prior to 15.1.5, 15.2 to 15.2.3, 15.3 to 15.3 to 15.3.1 allows an an authenticated user to achieve remote code e…
- Improper Neutralization of Special Elements Used in a Template Engine in GitLab AI Gateway
- Gitlab Community Edition version 10.3 is vulnerable to a lack of input validation in the system_hook_push queue through web hook component resulting in remote code execution.
- Gitlab Community Edition version 10.2.4 is vulnerable to a lack of input validation in the GitlabProjectsImportService resulting in remote code execution.
- An issue was discovered in GitLab Community and Enterprise Edition 11.11. A specially crafted payload would allow an authenticated malicious user to execute commands remotely thro…
- A command injection exists in GitLab CE/EE <v12.3.2, <v12.2.6, and <v12.1.12 that allowed an attacker to inject commands via the API through the blobs scope.
- An issue was discovered in GitLab Community and Enterprise Edition before 11.7.10, 11.8.x before 11.8.6, and 11.9.x before 11.9.4. A regex input validation issue for the .gitlab-c…
- GitLab 5.0 before 5.4.2, Community Edition before 6.2.4, Enterprise Edition before 6.2.1 and gitlab-shell before 1.7.8 allows remote attackers to execute arbitrary code via a craf…
- An issue was discovered in GitLab Community and Enterprise Edition before 11.11.8, 12 before 12.0.6, and 12.1 before 12.1.6. Gitaly allows injection of command-line flags. This so…
- In all versions of GitLab CE/EE starting from 0.8.0 before 14.2.6, all versions starting from 14.3 before 14.3.4, and all versions starting from 14.4 before 14.4.1 certain Unicode…
- Improper sanitization of branch names in GitLab Runner affecting all versions prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows a user who creates a branch wi…
- An issue was identified in GitLab CE/EE affecting all versions from 1.0 prior to 15.8.5, 15.9 prior to 15.9.4, and 15.10 prior to 15.10.1 where non-printable characters gets copie…
- Improper Neutralization of Special Elements used in a Command ('Command Injection') in GitLab
- An issue has been discovered in GitLab CE/EE affecting all versions from 8.6 before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 befor…
- Improper Neutralization of Special Elements Used in a Template Engine in GitLab AI Gateway
- Improper Neutralization of Special Elements used in a Command ('Command Injection') in GitLab
- Improper Control of Generation of Code ('Code Injection') in GitLab
- Improper Control of Generation of Code ('Code Injection') in GitLab
- Improper Control of Generation of Code ('Code Injection') in GitLab
- Improper Control of Generation of Code ('Code Injection') in GitLab
- Improper Control of Generation of Code ('Code Injection') in GitLab
- Improper Control of Generation of Code ('Code Injection') in GitLab
- Improper Neutralization of Special Elements used in a Command ('Command Injection') in GitLab
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-15 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.