Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Arbitrary escape sequence injection in docker-machine from worker nodes#1916285 | Informative | Command and Code Injection | Low | 2023-06-02 | – | 5 |
| Sending Arbitrary Requests through Jupyter Notebooks on gitlab.com and Self-Hosted GitLab Instances#970869 | Valid | Command and Code Injection | – | 2022-02-10 | – | 15 |
| CSV injection in gitlab.com via issues export feature.#216243 | Valid | Command and Code Injection | – | 2017-07-21 | – | 20 |
| Vulnerability in project import leads to arbitrary command execution#378148 | Valid | Command and Code Injection | – | 2018-08-22 | – | 32 |
| Command injection by overwriting authorized_keys file through GitLab import#298873 | Valid | Command and Code Injection | – | 2018-04-27 | $2,000 | 50 |
| RCE via WikiCloth markdown rendering if the `rubyluabridge` gem is installed#1401444 | Valid | Command and Code Injection | – | 2022-04-12 | $3,000 | 50 |
| GitLab-Runner on Windows `DOCKER_AUTH_CONFIG` container host Command Injection#955016 | Valid | Command and Code Injection | – | 2020-11-04 | – | 77 |
| Git flag injection - Search API with scope 'blobs'Analysed#682442 | Valid | Command and Code Injection | – | 2019-12-15 | $7,000 | 130 |
| Send arbitrary PUT requests when user clicks on a linkAnalysed#824689 | Valid | Command and Code Injection | – | 2020-07-27 | – | 135 |
| Path traversal, to RCEAnalysed#733072 | Valid | Command and Code Injection | – | 2022-06-07 | $12,000 | 142 |
| Git flag injection leading to file overwrite and potential remote code executionAnalysed#653125 | Valid | Command and Code Injection | – | 2019-12-19 | $3,500 | 169 |
| RCE via github import#1672388 | Valid | Command and Code Injection | Critical | 2022-11-16 | – | 271 |
| RCE via the DecompressedArchiveSizeValidator and Project BulkImports (behind feature flag)Analysed#1609965 | Valid | Command and Code Injection | Critical | 2022-09-13 | $33,510 | 387 |
| Remote Command Execution via Github importAnalysed#1679624 | Valid | Command and Code Injection | Critical | 2022-10-06 | $33,510 | 392 |
| RCE via unsafe inline Kramdown options when rendering certain Wiki pagesAnalysed#1125425 | Valid | Command and Code Injection | – | 2021-04-20 | $20,000 | 427 |
| RCE when removing metadata with ExifToolAnalysed#1154542 | Valid | Command and Code Injection | – | 2021-05-14 | $20,000 | 508 |
| Local files could be overwritten in GitLab, leading to remote command executionAnalysed#587854 | Valid | Command and Code Injection | – | 2019-07-17 | $12,000 | 542 |
| Git flag injection - local file overwrite to remote code executionAnalysed#658013 | Valid | Command and Code Injection | – | 2019-12-19 | $12,000 | 777 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (779 analysed so far), which can be wrong. Data as of 2026-11-14.