Unrated severityNVD Advisory· Published Aug 27, 2025· Updated Aug 27, 2025
Improper Control of Generation of Code ('Code Injection') in GitLab
CVE-2025-5101
Description
An issue has been discovered in GitLab CE/EE affecting all versions before 18.1.5, 18.2 before 18.2.5, and 18.3 before 18.3.1 that under certain conditions could have allowed an authenticated attacker to distribute malicious code that appears harmless in the web interface by taking advantage of ambiguity between branches and tags during repository imports.
Affected products
2cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*range: 0
- (no CPE)range: <18.1.5, >=18.2 <18.2.5, >=18.3 <18.3.1
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
2- hackerone.com/reports/3124199mitretechnical-descriptionexploitpermissions-required
- gitlab.com/gitlab-org/gitlab/-/issues/545165mitreissue-trackingpermissions-required
News mentions
1- GitLab Patch Release: 18.3.1, 18.2.5, 18.1.5GitLab Security Releases · Aug 27, 2025