A critical code injection vulnerability has been patched in GitLab, a popular platform for code management and sharing. The flaw, tracked as CVE-2026-19478, allows attackers to modify or delete user data and public projects without needing authentication.
The security defect was discovered through GitLab’s HackerOne bug bounty program and affects all versions of the GitLab Community Edition (CE) and Enterprise Edition (EE) from 18.2 onwards. The vulnerability is particularly concerning because it can be exploited via a GraphQL directive, which is a feature designed to make it easier for developers to interact with the platform.
In essence, GraphQL allows users to request specific data or operations from the GitLab server, rather than relying on traditional APIs that return large amounts of irrelevant information. However, in this case, an attacker can use a malicious GraphQL query to inject code into the system and execute unauthorized mutations. This could lead to sensitive data being compromised or even deleted.
GitLab has released patches for all affected versions, including CE/EE 18.11.11, 19.0.8, 19.1.6, and 19.2.4. The company is urging self-managed installations to upgrade immediately, as the patches will be automatically applied to GitLab.com and GitLab Dedicated.
The second vulnerability patched by GitLab is a cross-site request forgery (CSRF) issue impacting the GraphQL multiplex query handler. While not as critical as the code injection flaw, this bug still poses a risk if exploited, allowing an attacker to execute unauthorized actions on behalf of a user.
It’s worth noting that neither of these vulnerabilities have been reported to be exploited in the wild, but it’s always better to err on the side of caution when dealing with potential security risks. As always, users should keep their software up-to-date and monitor for any suspicious activity to minimize the risk of exploitation.
For those using GitLab, this serves as a reminder that even seemingly secure systems can have vulnerabilities that need attention. Regularly checking for updates and staying informed about potential threats is crucial in maintaining the security of your projects and data.
Source: SecurityWeek — 2026-08-18