Technical impact
GitLab Enterprise Edition contains an input injection flaw where specially crafted content can be inserted into the conversation context of its AI agent. This vulnerability, a form of CWE‑1427 and CWE‑74, arises from insufficient neutralization of special elements during prompt construction, enabling an authenticated user to embed instructions that the AI will treat as part of its execution path. The result is unintended command execution under the authority of other users, effectively allowing a user to induce the system to run code they do not normally control.
Affected Systems
All GitLab Enterprise Edition releases starting with 19.1 and up to but not including 19.2.8, releases from 19.3 up to but not including 19.3.5, and releases from 19.4 up to but not including 19.4.2 are susceptible. Any installation of these versions that has the AI agent feature enabled and is accessed by a logged‑in user may be vulnerable.
Risk and Exploitability
The CVSS base score of 7.3 indicates significant impact, while the EPSS score is < 1%, making exploitation likelihood difficult to quantify but the absence from KEV suggests no widespread exploitation to date. The flaw requires authentication and operates through the internal AI module, giving the attacker the ability to influence the AI’s instruction set. Even though the attack surface is limited to legitimate users, the potential to cause commands to run under other accounts makes this a high‑risk exposure for organizations utilizing GitLab’s AI features.
