CVE-2025-6945

Published: Nov 15, 2025Modified: Oct 19, 2026

3.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

Exploitability: 2.1 / Impact: 1.4

Source: cve@gitlab.com (Secondary)

Description

GitLab has remediated an issue in GitLab EE affecting all versions from 17.8 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2 that could have allowed an authenticated attacker to leak sensitive information from confidential issues by injecting hidden prompts into merge request comments.

Affected (3)

Products: Gitlab: Gitlab

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Gitlab Gitlab	17.9.0 ≤ version < 18.3.6
Gitlab Gitlab	18.4.0 ≤ version < 18.4.4
Gitlab Gitlab	18.5.0 ≤ version < 18.5.2

Related CWEs

Improper Neutralization of Special Elements used in a Command ('Command Injection')

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

References (3)

https://about.gitlab.com/releases/2025/11/12/patch-release-gitlab-18-5-2-released/

Source: cve@gitlab.com

Release NotesVendor Advisory

https://gitlab.com/gitlab-org/gitlab/-/issues/552611

Source: cve@gitlab.com

Broken Link

https://hackerone.com/reports/3173458

Source: cve@gitlab.com

Permissions Required

Timeline

No history available yet.