GitLab Enterprise Edition up to 18.3.5/18.4.3/18.5.1 Merge Request command injection

Summaryinfo

A vulnerability was found in GitLab Enterprise Edition up to 18.3.5/18.4.3/18.5.1. It has been rated as critical. This vulnerability affects unknown code of the component Merge Request Handler. Performing a manipulation results in command injection. This vulnerability is reported as CVE-2025-6945. The attack is possible to be carried out remotely. No exploit exists. Upgrading the affected component is advised.

Detailsinfo

A vulnerability classified as problematic has been found in GitLab Enterprise Edition up to 18.3.5/18.4.3/18.5.1. This affects an unknown function of the component Merge Request Handler. The manipulation with an unknown input leads to a command injection vulnerability. CWE is classifying the issue as CWE-77. The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. This is going to have an impact on confidentiality. The summary by CVE is:

GitLab has remediated an issue in GitLab EE affecting all versions from 17.8 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2 that could have allowed an authenticated attacker to leak sensitive information from confidential issues by injecting hidden prompts into merge request comments.

The weakness was disclosed by rogerace as 552611. The advisory is shared at about.gitlab.com. This vulnerability is uniquely identified as CVE-2025-6945 since 07/01/2025. The exploitability is told to be easy. It is possible to initiate the attack remotely. It demands that the victim is doing some kind of user interaction. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1202 for this issue.

The vulnerability scanner Nessus provides a plugin with the ID 298854 (GitLab 17.8 < 18.3.6 / 18.4 < 18.4.4 / 18.5 < 18.5.2 (CVE-2025-6945)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 18.3.6, 18.4.4 or 18.5.2 eliminates this vulnerability. The upgrade is hosted for download at about.gitlab.com.

The vulnerability is also documented in the databases at Tenable (298854), EUVD (EUVD-2025-197691) and CERT Bund (WID-SEC-2025-2587). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Affected

• Open Source GitLab

Productinfo

Type

• Bug Tracking Software

Vendor

• GitLab

Name

• Enterprise Edition

Version

• 18.3.0
• 18.3.1
• 18.3.2
• 18.3.3
• 18.3.4
• 18.3.5
• 18.4.0
• 18.4.1
• 18.4.2
• 18.4.3
• 18.5.0
• 18.5.1

License

• commercial

Website

• Vendor: https://gitlab.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion