Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| RCE when removing metadata with ExifToolAnalysed#1154542 | Valid | Command and Code Injection | Critical | 2021-05-14 | $20,000 | 508 |
| RCE via unsafe inline Kramdown options when rendering certain Wiki pagesAnalysed#1125425 | Valid | Command and Code Injection | Critical | 2021-04-20 | $20,000 | 427 |
| Stored XSS in markdown via the DesignReferenceFilterAnalysed#1212067 | Valid | Cross-site Scripting | Critical | 2021-10-18 | $16,000 | 317 |
| Arbitrary file read during project importAnalysed#1132378 | Valid | File and Path Handling | Critical | 2021-05-24 | $16,000 | 194 |
| Stored XSS in custom emojiAnalysed#1198517 | Valid | Cross-site Scripting | High | 2021-07-19 | $3,000 | 130 |
| XSS in request approvalsAnalysed#402658 | Valid | Cross-site Scripting | Medium | 2021-04-23 | $3,000 | 96 |
| Stored XSS in main page of a project caused by arbitrary script payload in group "Default initial branch name"Analysed#1256777 | Valid | Cross-site Scripting | High | 2021-09-15 | – | 80 |
| Privilege escalation of "external user" (with maintainer privilege) to internal access through project tokenAnalysed#1193062 | Valid | Access Control | Medium | 2021-10-11 | – | 66 |
| Stored-XSS on wiki pagesAnalysed#1087061 | Valid | Cross-site Scripting | Medium | 2021-07-13 | – | 59 |
| Stored XSS via Mermaid Prototype Pollution vulnerabilityAnalysed#1106238 | Valid | Cross-site Scripting | High | 2021-07-12 | $3,000 | 58 |
| FogBugz import attachment full SSRF requiring vulnerability in *.fogbugz.comAnalysed#1092230 | Valid | Server-Side Request Forgery | High | 2021-07-13 | – | 58 |
| Change project visibility to a restricted optionAnalysed#1086781 | Valid | Misconfiguration and Insecure Design | Medium | 2021-12-30 | $1,370 | 51 |
| Stored XSS on the job pageAnalysed#856554 | Valid | Cross-site Scripting | High | 2021-01-08 | $3,000 | 50 |
| Guest users can create new test casesAnalysed#1113289 | Valid | Access Control | Medium | 2021-08-30 | $650 | 49 |
| View the Starred Projects in a Private ProfileAnalysed#703894 | Valid | Insecure Direct Object Reference | Low | 2021-02-02 | $500 | 49 |
| Stored XSS via Mermaid Prototype Pollution vulnerabilityAnalysed#1280002 | Valid | Cross-site Scripting | High | 2021-11-18 | $3,000 | 48 |
| A deactivated user can access data through GraphQLAnalysed#1192460 | Valid | Access Control | Medium | 2021-08-30 | – | 47 |
| Stored XSS in Mermaid when viewing Markdown filesAnalysed#1212822 | Valid | Cross-site Scripting | High | 2021-10-18 | – | 42 |
| Kroki Arbitrary File Read/WriteAnalysed#1098793 | Valid | Access Control | High | 2021-05-21 | $5,600 | 41 |
| When you call your branch the same name as a git hash, it could be checked out by dependentsAnalysed#790634 | Valid | Injection and Smuggling | Medium | 2021-08-19 | $2,000 | 39 |
| Clipboard DOM-based XSSAnalysed#1196958 | Valid | Cross-site Scripting | Medium | 2021-08-19 | – | 35 |
| Stored-XSS in merge requestsAnalysed#977697 | Valid | Cross-site Scripting | High | 2021-07-13 | – | 33 |
| Guest Users can create issues for Sentry errors and track their statusAnalysed#1117768 | Valid | Access Control | Low | 2021-09-24 | $610 | 29 |
| Able to leak private email of any user given his/her username via graphqlAnalysed#972355 | Valid | Information Disclosure | Medium | 2021-01-08 | – | 29 |
| Stored DOM XSS via Mermaid chartAnalysed#1103258 | Valid | Cross-site Scripting | High | 2021-07-12 | $3,000 | 27 |
| Reporters can upload design to issues using the "Move to" featureAnalysed#1112297 | Valid | Access Control | Medium | 2021-10-18 | $600 | 21 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (4,365 analysed so far), which can be wrong. Data as of 2026-11-15.