Gitlab · Gitlab Runner · CVE-2022-2251
**Name of the Vulnerable Software and Affected Versions**
GitLab Runner versions prior to 15.3.5
GitLab Runner versions 15.4 prior to 15.4.4
GitLab Runner versions 15.5 prior to 15.5.2
**Description**
The issue is caused by improper sanitization of branch names, allowing a user to create a branch with a specially crafted name. If another user triggers a pipeline, this can lead to the execution of commands in the runner as that other user.
**Recommendations**
For versions prior to 15.3.5, update to version 15.3.5 or later.
For versions 15.4 prior to 15.4.4, update to version 15.4.4 or later.
For versions 15.5 prior to 15.5.2, update to version 15.5.2 or later.