PT-2025-31109 · Gitlab · Gitlab Language Server

Published 2025-07-28 · Updated 2025-08-11 · CVE-2025-8279

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GitLab Language Server versions 7.6.0 through 7.29.0

Description Insufficient input validation within GitLab Language Server allows arbitrary GraphQL query execution.

Recommendations Update to GitLab Language Server version 7.30.0 or later.

Exploit

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2025-8279

Affected Products

Gitlab Language Server

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/8xxx/CVE-2025-8279.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-8279 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-8279 · Security Note
• https://twitter.com/CveFindCom/status/1949842149257654320 · Twitter Post
• https://twitter.com/Hossted_OSS/status/1954794308336308702 · Twitter Post
• https://twitter.com/CVEnew/status/1949837452564222095 · Twitter Post
• https://gitlab.com/gitlab-org/gitlab/-/issues/538205 · Note
• https://t.me/CVEtracker/28577 · Telegram Post
• https://twitter.com/marcin_brz81183/status/1949841546020323725 · Twitter Post