Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Command injection by overwriting authorized_keys file through GitLab importAnalysed#298873 | Valid | Command and Code Injection | Critical | 2018-04-27 | $2,000 | 50 |
| GitLab CI runner can read and poison cache of all other projectsAnalysed#301432 | Valid | File and Path Handling | Critical | 2018-04-27 | $2,000 | 43 |
| SQL injection in MilestoneFinder order methodAnalysed#298176 | Valid | SQL Injection | Critical | 2018-04-27 | $2,000 | 41 |
| Using GitLab to monitor and hijack domains in mass quantity.Analysed#312118 | Valid | Input Validation and Logic | High | 2018-02-21 | $750 | 39 |
| Evaluating Ruby code by injecting Rescue job on the system_hook_push queue through web hookAnalysed#299473 | Valid | Server-Side Request Forgery | High | 2018-04-27 | $750 | 36 |
| Vulnerability in project import leads to arbitrary command executionAnalysed#378148 | Valid | Command and Code Injection | Critical | 2018-08-22 | – | 32 |
| Unauthorized users may be able to view almost all informations related to Private projects.Analysed#407763 | Valid | Information Disclosure | Medium | 2018-12-03 | – | 24 |
| HTML TAG INJECTION ON PROFILE NAMEAnalysed#358001 | Valid | Cross-site Scripting | Low | 2018-07-27 | – | 19 |
| Stored XSS in merge request pagesAnalysed#409380 | Valid | Cross-site Scripting | High | 2018-12-03 | – | 18 |
| Stored XSS on Issue details pageAnalysed#384255 | Valid | Cross-site Scripting | High | 2018-10-30 | – | 16 |
| GitHub import allows user to create child group under existing namespaceAnalysed#301137 | Valid | Access Control | High | 2018-05-24 | $750 | 14 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.