by Kastro
Paper/Archive/CVE-2026-19478

CVE-2026-19478

GitLab GitLab — Improper Control of Generation of Code ('Code Injection') in GitLab

EPSS 2%CVSS 9.4
critical.is priorityof 100
45
CVSS 9.4 (CNA)9.4 / 10 × 3028.2Not in CISA KEV+300.0EPSS percentile 82.2.822 × 2016.4No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could allow an unauthenticated user to remotely modify or delete public projects and user data via a GraphQL directive.

Affected

ProductAffectedFixed inSource
GitLab18.2 – < 18.11.1118.11.11CNA
GitLab19.0 – < 19.0.819.0.8CNA
GitLab19.1 – < 19.1.619.1.6CNA
GitLab19.2 – < 19.2.419.2.4CNA

Scores by source

GitLab (CNA)9.4CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

refgitlab.com/gitlab-org/gitlab/-/work_items/611377exploithackerone.com/reports/3926431refdocs.gitlab.com/releases/patches/patch-release-gitlab-19-2-4-released