Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Command injection by overwriting authorized_keys file through GitLab importAnalysed#298873 | Valid | Command and Code Injection | Critical | 2018-04-27 | $2,000 | 50 |
| GitLab CI runner can read and poison cache of all other projectsAnalysed#301432 | Valid | File and Path Handling | Critical | 2018-04-27 | $2,000 | 43 |
| SQL injection in MilestoneFinder order methodAnalysed#298176 | Valid | SQL Injection | Critical | 2018-04-27 | $2,000 | 41 |
| Using GitLab to monitor and hijack domains in mass quantity.Analysed#312118 | Valid | Input Validation and Logic | High | 2018-02-21 | $750 | 39 |
| Evaluating Ruby code by injecting Rescue job on the system_hook_push queue through web hookAnalysed#299473 | Valid | Server-Side Request Forgery | High | 2018-04-27 | $750 | 36 |
| Vulnerability in project import leads to arbitrary command executionAnalysed#378148 | Valid | Command and Code Injection | Critical | 2018-08-22 | – | 32 |
| Unauthorized users may be able to view almost all informations related to Private projects.Analysed#407763 | Valid | Information Disclosure | Medium | 2018-12-03 | – | 24 |
| HTML TAG INJECTION ON PROFILE NAME#358001 | Valid | Cross-site Scripting | Low | 2018-07-27 | – | 19 |
| Stored XSS in merge request pages#409380 | Valid | Cross-site Scripting | High | 2018-12-03 | – | 18 |
| Stored XSS on Issue details page#384255 | Valid | Cross-site Scripting | High | 2018-10-30 | – | 16 |
| GitHub import allows user to create child group under existing namespace#301137 | Valid | Access Control | High | 2018-05-24 | $750 | 14 |
| SSRF when importing a project from a git repo by URL#135937 | Valid | Information Disclosure | – | 2018-05-29 | – | 12 |
| Persistent XSS - Selecting users as allowed merge request approvers#346217 | Valid | Cross-site Scripting | Medium | 2018-07-16 | – | 11 |
| SSRF vulnerability in gitlab.com webhook#301924 | Valid | Server-Side Request Forgery | Medium | 2018-04-30 | – | 10 |
| XSS (Persistent) - Selecting role(s) for protected branches#346111 | Valid | Cross-site Scripting | High | 2018-07-16 | – | 8 |
| Persistent XSS - Deleting a project (No Longer Vulnerable in 10.7)#351554 | Valid | Cross-site Scripting | Medium | 2018-09-20 | – | 7 |
| Cookie bomb#221041 | Valid | Denial of Service | Medium | 2018-02-16 | – | 6 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (4,182 analysed so far), which can be wrong. Data as of 2026-11-15.