Nixpkgs security tracker

Login with GitHub

Suggestions search

All statuses
Filter by:
With package: gitlab-ee

Found 99 matching suggestions

View:
Compact
Detailed
Untriaged
Permalink CVE-2026-19650
7.1 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Required (R)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): High (H)
  • Availability (A): Low (L)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): Low (L)
created 3 weeks, 6 days ago Activity log
  • Created suggestion 3 weeks, 6 days ago
Cross-Site Request Forgery (CSRF) in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could have allowed an unauthenticated user to execute mutations via GET requests due to improper request validation in GraphQL multiplex query handling.

Affected products

GitLab
  • <19.1.6
  • <19.2.4
  • <18.11.11
  • <19.0.8

Matching in nixpkgs

pkgs.gitlab-art

Pull cross-project Gitlab artifact dependencies

pkgs.gitlab-clippy

Convert clippy warnings into GitLab Code Quality report

pkgs.gitlab-ci-validate

Command line tool to validate .gitlab-ci.yml files

  • nixos-unstable -
    • nixos-unstable-small 0.6.0

pkgs.gnomeExtensions.gitlab-time-tracking

Track time spent on GitLab issues with a convenient system tray timer.

  • nixos-unstable 4
    • nixpkgs-unstable 4
    • nixos-unstable-small 4
  • nixos-26.05 4
    • nixos-26.05-small 4
    • nixpkgs-26.05-darwin 4

Package maintainers

Published
Permalink CVE-2025-9486
3.3 LOW
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): High (H)
  • Privileges Required (PR): High (H)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): Low (L)
  • Integrity (I): Low (L)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Privileges Required (MPR): High (H)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): None (N)
updated 1 month ago by @LeSuisse Activity log
  • Created suggestion 1 month ago
  • @LeSuisse ignored
    40 packages
    • gitlab-art
    • gitlab-duo
    • gitlab-kas
    • gitlab-ci-ls
    • gitlab-pages
    • gitlab-shell
    • danger-gitlab
    • gitlab-clippy
    • gitlab-runner
    • gitlab-triage
    • gitlab-ci-local
    • gitlab-timelogs
    • gitlab-ci-linter
    • gitlab-workhorse
    • gitlab-ci-validate
    • gitlab-release-cli
    • ocamlPackages.gitlab
    • gitlab-container-registry
    • ocamlPackages.gitlab-jsoo
    • ocamlPackages.gitlab-unix
    • rubyPackages.gitlab-markup
    • terraform-providers.gitlab
    • ocamlPackages_latest.gitlab
    • gitlab-elasticsearch-indexer
    • haskellPackages.gitlab-haskell
    • rubyPackages_3_3.gitlab-markup
    • rubyPackages_3_4.gitlab-markup
    • rubyPackages_4_0.gitlab-markup
    • python313Packages.mkdocs-gitlab
    • python313Packages.python-gitlab
    • python314Packages.mkdocs-gitlab
    • python314Packages.python-gitlab
    • ocamlPackages_latest.gitlab-jsoo
    • ocamlPackages_latest.gitlab-unix
    • terraform-providers.gitlabhq_gitlab
    • gnomeExtensions.gitlab-time-tracking
    • prometheus-gitlab-ci-pipelines-exporter
    • vscode-extensions.gitlab.gitlab-workflow
    • perlPackages.AlienBuildPluginDownloadGitLab
    • perl5Packages.AlienBuildPluginDownloadGitLab
    1 month ago
  • @LeSuisse accepted 1 month ago
  • @LeSuisse published on GitHub 1 month ago
Incorrect Privilege Assignment in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 15.6 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed a user with a pending membership to receive permissions granted by a custom role, due to incorrect privilege assignment that did not account for membership state.

References

Affected products

GitLab
  • <19.1.4
  • <19.2.2
  • <19.0.6

Matching in nixpkgs

Ignored packages (40)

pkgs.gitlab-art

Pull cross-project Gitlab artifact dependencies

pkgs.gitlab-clippy

Convert clippy warnings into GitLab Code Quality report

pkgs.gitlab-ci-validate

Command line tool to validate .gitlab-ci.yml files

  • nixos-unstable -
    • nixos-unstable-small 0.6.0

pkgs.gnomeExtensions.gitlab-time-tracking

Track time spent on GitLab issues with a convenient system tray timer.

  • nixos-unstable 4
    • nixpkgs-unstable 4
    • nixos-unstable-small 4
  • nixos-26.05 4
    • nixos-26.05-small 4
    • nixpkgs-26.05-darwin 4

Package maintainers

Untriaged
Permalink CVE-2026-18433
4.3 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): Low (L)
  • Integrity (I): None (N)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): None (N)
updated 1 month ago by @LeSuisse Activity log
  • Created suggestion 1 month ago
  • @LeSuisse ignored package gitlab-art 1 month ago
Incorrect Authorization in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to read policy configuration belonging to a namespace they were not authorized to access, due to incorrect authorization checks in a GraphQL query.

Affected products

GitLab
  • <19.1.4
  • <19.2.2

Matching in nixpkgs

pkgs.gitlab-clippy

Convert clippy warnings into GitLab Code Quality report

pkgs.gitlab-ci-validate

Command line tool to validate .gitlab-ci.yml files

  • nixos-unstable -
    • nixos-unstable-small 0.6.0

pkgs.gnomeExtensions.gitlab-time-tracking

Track time spent on GitLab issues with a convenient system tray timer.

  • nixos-unstable 4
    • nixpkgs-unstable 4
    • nixos-unstable-small 4
  • nixos-26.05 4
    • nixos-26.05-small 4
    • nixpkgs-26.05-darwin 4
Ignored packages (1)

pkgs.gitlab-art

Pull cross-project Gitlab artifact dependencies

Package maintainers

Untriaged
Permalink CVE-2026-16494
7.1 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): High (H)
  • Availability (A): Low (L)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): Low (L)
created 1 month ago Activity log
  • Created suggestion 1 month ago
Missing Authorization in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to modify project settings restricted to higher-privileged roles, due to missing authorization checks on a project update endpoint.

Affected products

GitLab
  • <19.1.4
  • <19.2.2

Matching in nixpkgs

pkgs.gitlab-art

Pull cross-project Gitlab artifact dependencies

pkgs.gitlab-clippy

Convert clippy warnings into GitLab Code Quality report

pkgs.gitlab-ci-validate

Command line tool to validate .gitlab-ci.yml files

  • nixos-unstable -
    • nixos-unstable-small 0.6.0

pkgs.gnomeExtensions.gitlab-time-tracking

Track time spent on GitLab issues with a convenient system tray timer.

  • nixos-unstable 4
    • nixpkgs-unstable 4
    • nixos-unstable-small 4
  • nixos-26.05 4
    • nixos-26.05-small 4
    • nixpkgs-26.05-darwin 4

Package maintainers

Untriaged
Permalink CVE-2026-15216
8.7 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): Required (R)
  • Scope (S): Changed (C)
  • Confidentiality (C): High (H)
  • Integrity (I): High (H)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Changed (C)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): None (N)
created 1 month ago Activity log
  • Created suggestion 1 month ago
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed cross-site scripting due to improper neutralization of user-controlled data rendered in pagination controls by an analytics dashboard component.

Affected products

GitLab
  • <19.2.2
  • <19.1.4
  • <19.0.6

Matching in nixpkgs

pkgs.gitlab-art

Pull cross-project Gitlab artifact dependencies

pkgs.gitlab-clippy

Convert clippy warnings into GitLab Code Quality report

pkgs.gitlab-ci-validate

Command line tool to validate .gitlab-ci.yml files

  • nixos-unstable -
    • nixos-unstable-small 0.6.0

pkgs.gnomeExtensions.gitlab-time-tracking

Track time spent on GitLab issues with a convenient system tray timer.

  • nixos-unstable 4
    • nixpkgs-unstable 4
    • nixos-unstable-small 4
  • nixos-26.05 4
    • nixos-26.05-small 4
    • nixpkgs-26.05-darwin 4

Package maintainers

Untriaged
Permalink CVE-2026-16627
7.7 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): High (H)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): Required (R)
  • Scope (S): Changed (C)
  • Confidentiality (C): High (H)
  • Integrity (I): High (H)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Changed (C)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): None (N)
created 1 month ago Activity log
  • Created suggestion 1 month ago
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to escalate privileges due to improper sanitization of HTML content rendered in a CI job modal.

Affected products

GitLab
  • <19.2.2

Matching in nixpkgs

pkgs.gitlab-art

Pull cross-project Gitlab artifact dependencies

pkgs.gitlab-clippy

Convert clippy warnings into GitLab Code Quality report

pkgs.gitlab-ci-validate

Command line tool to validate .gitlab-ci.yml files

  • nixos-unstable -
    • nixos-unstable-small 0.6.0

pkgs.gnomeExtensions.gitlab-time-tracking

Track time spent on GitLab issues with a convenient system tray timer.

  • nixos-unstable 4
    • nixpkgs-unstable 4
    • nixos-unstable-small 4
  • nixos-26.05 4
    • nixos-26.05-small 4
    • nixpkgs-26.05-darwin 4

Package maintainers

Untriaged
Permalink CVE-2026-18244
4.3 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): Low (L)
  • Integrity (I): None (N)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): None (N)
created 1 month ago Activity log
  • Created suggestion 1 month ago
Missing Authorization in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 17.7 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to view restricted configuration settings due to improper authorization checks on a group settings page.

Affected products

GitLab
  • <19.2.2
  • <19.1.4
  • <19.0.6

Matching in nixpkgs

pkgs.gitlab-art

Pull cross-project Gitlab artifact dependencies

pkgs.gitlab-clippy

Convert clippy warnings into GitLab Code Quality report

pkgs.gitlab-ci-validate

Command line tool to validate .gitlab-ci.yml files

  • nixos-unstable -
    • nixos-unstable-small 0.6.0

pkgs.gnomeExtensions.gitlab-time-tracking

Track time spent on GitLab issues with a convenient system tray timer.

  • nixos-unstable 4
    • nixpkgs-unstable 4
    • nixos-unstable-small 4
  • nixos-26.05 4
    • nixos-26.05-small 4
    • nixpkgs-26.05-darwin 4

Package maintainers

Untriaged
Permalink CVE-2026-19228
8.5 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Changed (C)
  • Confidentiality (C): None (N)
  • Integrity (I): High (H)
  • Availability (A): Low (L)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Changed (C)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): Low (L)
created 1 month ago Activity log
  • Created suggestion 1 month ago
Authorization Bypass Through User-Controlled Key in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to cause AI usage to be attributed to another namespace, due to improper authorization of identity information supplied in requests.

Affected products

GitLab
  • <19.1.4
  • <19.2.2

Matching in nixpkgs

pkgs.gitlab-art

Pull cross-project Gitlab artifact dependencies

pkgs.gitlab-clippy

Convert clippy warnings into GitLab Code Quality report

pkgs.gitlab-ci-validate

Command line tool to validate .gitlab-ci.yml files

  • nixos-unstable -
    • nixos-unstable-small 0.6.0

pkgs.gnomeExtensions.gitlab-time-tracking

Track time spent on GitLab issues with a convenient system tray timer.

  • nixos-unstable 4
    • nixpkgs-unstable 4
    • nixos-unstable-small 4
  • nixos-26.05 4
    • nixos-26.05-small 4
    • nixpkgs-26.05-darwin 4

Package maintainers

Untriaged
Permalink CVE-2026-15423
8.5 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Changed (C)
  • Confidentiality (C): Low (L)
  • Integrity (I): High (H)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Changed (C)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): None (N)
created 1 month ago Activity log
  • Created suggestion 1 month ago
Incorrect Authorization in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to execute CI/CD pipelines on a protected branch without the required push permissions due to improper authorization in pipeline reference validation.

Affected products

GitLab
  • <19.2.2
  • <19.1.4
  • <19.0.6

Matching in nixpkgs

pkgs.gitlab-art

Pull cross-project Gitlab artifact dependencies

pkgs.gitlab-clippy

Convert clippy warnings into GitLab Code Quality report

pkgs.gitlab-ci-validate

Command line tool to validate .gitlab-ci.yml files

  • nixos-unstable -
    • nixos-unstable-small 0.6.0

pkgs.gnomeExtensions.gitlab-time-tracking

Track time spent on GitLab issues with a convenient system tray timer.

  • nixos-unstable 4
    • nixpkgs-unstable 4
    • nixos-unstable-small 4
  • nixos-26.05 4
    • nixos-26.05-small 4
    • nixpkgs-26.05-darwin 4

Package maintainers

Untriaged
Permalink CVE-2026-7427
5.3 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): None (N)
  • Availability (A): Low (L)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): Low (L)
created 1 month ago Activity log
  • Created suggestion 1 month ago
Allocation of Resources Without Limits or Throttling in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.5 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an unauthenticated user to cause a denial of service due to improper input validation.

Affected products

GitLab
  • <19.2.2
  • <19.1.4
  • <19.0.6

Matching in nixpkgs

pkgs.gitlab-art

Pull cross-project Gitlab artifact dependencies

pkgs.gitlab-clippy

Convert clippy warnings into GitLab Code Quality report

pkgs.gitlab-ci-validate

Command line tool to validate .gitlab-ci.yml files

  • nixos-unstable -
    • nixos-unstable-small 0.6.0

pkgs.gnomeExtensions.gitlab-time-tracking

Track time spent on GitLab issues with a convenient system tray timer.

  • nixos-unstable 4
    • nixpkgs-unstable 4
    • nixos-unstable-small 4
  • nixos-26.05 4
    • nixos-26.05-small 4
    • nixpkgs-26.05-darwin 4

Package maintainers