CVE-2025-2867 MEDIUM

CVE-2025-2867: Improper Control of Generation of Code ('Code Injection') in GitLab

Vendor Gitlab

Product GitLab

Weakness CWE-94 · Code injection

Published March 27, 2025

Last update March 27, 2025

View on NVD All CVEs

CVSS base score

4.4/10

Attack vector Network

Attack complexity High

Privileges required Low

User interaction Required

Confidentiality Low

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N

What the vulnerability does

01Description

An issue has been discovered in the GitLab Duo with Amazon Q affecting all versions from 17.8 before 17.8.6, 17.9 before 17.9.3, and 17.10 before 17.10.1. A specifically crafted issue could manipulate AI-assisted development features to potentially expose sensitive project data to unauthorized users.

Key dates

02Disclosure timeline

March 27, 2025 CVE published

March 27, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-2867 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/94.html

Identifiers

CVE CVE-2025-2867

CWE CWE-94

CVSS 4.4 / MEDIUM

Affected versions

Vendor Gitlab

Product GitLab

Affected ≥ 17.8 and < 17.8.6

Vendor Gitlab

Product GitLab

Affected ≥ 17.9 and < 17.9.3

Vendor Gitlab

Product GitLab

Affected ≥ 17.10 and < 17.10.1