Unrated severityNVD Advisory· Published Mar 27, 2025· Updated Mar 27, 2025
Improper Neutralization of Special Elements used in a Command ('Command Injection') in GitLab
CVE-2024-9773
Description
An issue was discovered in GitLab EE affecting all versions starting from 14.9 before 17.8.6, all versions starting from 17.9 before 17.8.3, all versions starting from 17.10 before 17.10.1. An input validation issue in the Harbor registry integration could have allowed a maintainer to add malicious code to the CLI commands shown in the UI.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*range: 14.9
- (no CPE)range: >=14.9 <17.8.6 || >=17.9 <17.8.3 || >=17.10 <17.10.1
Patches
Vulnerability mechanics
References
2- hackerone.com/reports/2671808mitretechnical-descriptionexploitpermissions-required
- gitlab.com/gitlab-org/gitlab/-/issues/498557mitreissue-trackingpermissions-required
News mentions
1- GitLab Patch Release: 17.10.1, 17.9.3, 17.8.6GitLab Security Releases · Mar 26, 2025