An unauthenticated code injection vulnerability in GitLab allows remote attackers to manipulate project and user data, presenting a critical risk to platform integrity.

This is an Improper Control of Generation of Code (CWE-94) vulnerability. It enables an unauthenticated attacker to execute unauthorized actions against public projects and user data by leveraging a specific GraphQL directive.

With a CVSS score of 9.4, this vulnerability is extremely severe as it allows unauthenticated remote access to modify or destroy project data. This could result in catastrophic data loss, unauthorized alteration of source code, and reputational damage. The ability to target user data further elevates the risk to the privacy and security of all platform participants.

Immediate Action: Upgrade GitLab to versions 18.11.11, 19.0.8, 19.1.6, 19.2.4, or later immediately.

Proactive Monitoring: Review audit logs for unexpected GraphQL queries or suspicious API activity originating from unauthorized or external IP addresses.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to filter and block malicious GraphQL directives or unexpected API requests that target project management endpoints.

Public Exploit Available: Unknown

This vulnerability is critical and requires immediate attention to prevent unauthorized data modification. GitLab administrators must apply the provided patches across all affected instances without delay to secure their environments against potential remote exploitation.