CVE-2024-7110
Improper Neutralization of Special Elements used in a Command ('Command Injection') in GitLab
Vexday Risk Score
13Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS 6.4EPSS 0.3%KEV nãoPoC —Nuclei —Metasploit —Patch —
Lifecycle
22 Aug 2024Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
An issue was discovered in GitLab EE affecting all versions starting 17.0 to 17.1.6, 17.2 prior to 17.2.4, and 17.3 prior to 17.3.1 allows an attacker to execute arbitrary command in a victim's pipeline through prompt injection.
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N
Affected products
GitLab · GitLabWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →