SQL injection in MilestoneFinder order method #298176 Valid SQL Injection – 2018-04-27 $2,000 41 Kroki Arbitrary File Read/Write #1098793 Valid Access Control – 2021-05-21 $5,600 41 Stored XSS in Mermaid when viewing Markdown files #1212822 Valid Cross-site Scripting – 2021-10-18 – 42 GitLab CI runner can read and poison cache of all other projects #301432 Valid File and Path Handling – 2018-04-27 $2,000 43 Milestones leaked via search API #460815 Valid Access Control – 2019-07-19 – 43 XSS: `v-safe-html` is not safe enough #1579645 Valid Cross-site Scripting – 2022-11-16 – 43 A deactivated user can access data through GraphQL #1192460 Valid Access Control – 2021-08-30 – 47 Stored XSS via Mermaid Prototype Pollution vulnerability #1280002 Valid Cross-site Scripting – 2021-11-18 $3,000 48 View the Starred Projects in a Private Profile #703894 Valid Insecure Direct Object Reference – 2021-02-02 $500 49 XSS on Issue reference numbers #831962 Valid Cross-site Scripting – 2020-11-23 – 49 Guest users can create new test cases #1113289 Valid Access Control – 2021-08-30 $650 49 Improper access control for users with expired password, giving the user full access through API and Git #1285226 Valid Access Control – 2022-01-27 – 49 Command injection by overwriting authorized_keys file through GitLab import #298873 Valid Command and Code Injection – 2018-04-27 $2,000 50 Clientside resource Exhausting by exploiting gitlab math rendering #549040 Valid Denial of Service – 2019-10-01 – 50 Stored XSS in markdown when redacting references #836649 Valid Cross-site Scripting – 2020-09-09 $5,000 50 Stored XSS on the job page #856554 Valid Cross-site Scripting – 2021-01-08 $3,000 50 RCE via WikiCloth markdown rendering if the `rubyluabridge` gem is installed #1401444 Valid Command and Code Injection – 2022-04-12 $3,000 50 Change project visibility to a restricted option #1086781 Valid Misconfiguration and Insecure Design – 2021-12-30 $1,370 51 All functions that allow users to specify color code are vulnerable to ReDoS #511381 Valid Denial of Service – 2019-08-21 $1,000 53 Stored XSS in merge request pages #723307 Valid Cross-site Scripting – 2023-05-30 $3,500 53 Access to GitLab's Slack by abusing issue creation from e-mail #218230 Valid Authentication – 2017-09-21 – 54 Arbitrary POST request as victim user from HTML injection in Jupyter notebooks #1409788 Valid Injection and Smuggling – 2022-05-20 – 54 EXIF metadata not stripped from JPG group logos #446238 Valid Information Disclosure – 2020-09-08 $500 55 Bypass Email Verification using Salesforce -- Reproducible in gitlab.com #617896 Valid Misconfiguration and Insecure Design – 2019-12-13 – 55 Content injection in Jira issue title enabling sending arbitrary POST request as victim #1533976 Valid Injection and Smuggling – 2022-09-22 – 55 Know whether private project name exists or not within a group using link comments #495497 Valid Information Disclosure – 2019-10-07 – 58 FogBugz import attachment full SSRF requiring vulnerability in *.fogbugz.com #1092230 Valid Server-Side Request Forgery – 2021-07-13 – 58 Stored XSS via Mermaid Prototype Pollution vulnerability #1106238 Valid Cross-site Scripting – 2021-07-12 $3,000 58 Stored-XSS on wiki pages #1087061 Valid Cross-site Scripting – 2021-07-13 – 59 [Admin Panel] CSRF to resume/pause runner #415238 Valid Cross-Site Request Forgery – 2020-12-01 – 60 Ability to access all user authentication tokens, leads to RCE #158330 Valid Access Control – 2016-11-03 – 61 HTML injection possible with soft email confirmations when Administrator manually confirms attacker email address #1935628 Valid Injection and Smuggling Low 2024-10-08 $1,060 61 GraphQL query "namespace" leaks data #614355 Valid Access Control – 2019-12-03 – 64 DOS: taking down a 1k users Gitlab EE instance or multiple Sidekiq instances by importing a malicious repo from a Github EE self-hosted server #2499070 Valid Denial of Service Medium 2024-10-09 $2,300 64 Privilege escalation of "external user" (with maintainer privilege) to internal access through project token #1193062 Valid Access Control – 2021-10-11 – 66 Login email verification bypass via `/oauth/token`. #2676025 Informative Authentication None 2024-09-03 – 66 Stored-XSS injected in Wiki page via Banzai pipeline #2257080 Valid Cross-site Scripting High 2024-05-28 – 71 SSRF in CI after first run #369451 Valid Server-Side Request Forgery – 2019-04-12 – 72 GitLab::UrlBlocker validation bypass leading to full Server Side Request Forgery #541169 Valid Server-Side Request Forgery – 2019-12-12 – 72 Remove obsolete domain from handbook subdomain #2599840 Valid Misconfiguration and Insecure Design Low 2024-10-01 – 72 GitLab-Runner on Windows `DOCKER_AUTH_CONFIG` container host Command Injection #955016 Valid Command and Code Injection – 2020-11-04 – 77 Subdomain takeover in Gitlab pages #2523654 Valid Misconfiguration and Insecure Design Low 2024-10-09 – 79 Stored XSS in main page of a project caused by arbitrary script payload in group "Default initial branch name" #1256777 Valid Cross-site Scripting – 2021-09-15 – 80 XSS in ZenTao integration affecting self hosted instances without strict CSP #1542510 Valid Cross-site Scripting – 2022-09-22 – 81 Cache poisoning Denial of Service affecting assets.gitlab-static.net #1160407 Valid Denial of Service – 2021-12-22 – 83 DoS attack via comment on Issue #557154 Valid Denial of Service – 2019-11-21 $1,000 84 Path traversal in Nuget Package Registry #822262 Valid File and Path Handling – 2022-06-07 $12,000 88 CSRF on /api/graphql allows executing mutations through GET requests #1122408 Valid Cross-Site Request Forgery – 2021-08-02 $3,370 88 Stored XSS in "Create Groups" #647130 Valid Cross-site Scripting – 2020-08-26 $2,500 89 RepositoryPipeline allows importing of local git repos #1685822 Valid Access Control – 2022-11-04 $22,300 89