PT-2025-46905 · Gitlab · Gitlab Duo

Published

2025-11-12

·

Updated

2025-11-24

·

CVE-2025-6945

CVSS v2.0

4.0

Medium

VectorAV:N/AC:L/Au:S/C:P/I:N/A:N
Name of the Vulnerable Software and Affected Versions GitLab EE versions 17.8 through 18.3.6 GitLab EE versions 18.4 through 18.4.4 GitLab EE versions 18.5 through 18.5.2
Description An authenticated attacker could potentially leak sensitive information from confidential issues. This is possible by injecting hidden prompts into merge request comments. The issue affects GitLab EE and is related to prompt injection, where malicious input can manipulate the behavior of an application. The vulnerability resides in the handling of merge request comments and could allow unauthorized disclosure of confidential data.
Recommendations GitLab EE versions 17.8 through 18.3.6 should be updated to version 18.3.6 or later. GitLab EE versions 18.4 through 18.4.4 should be updated to version 18.4.4 or later. GitLab EE versions 18.5 through 18.5.2 should be updated to version 18.5.2 or later.

Exploit

Fix

Command Injection

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2025-14467
BIT-GITLAB-2025-6945
CVE-2025-6945

Affected Products

Gitlab Duo