GitLab issued emergency patches for a CVSS 10.0 flaw letting attackers run code without logging in, affecting versions back ...

GitLab’s non-expiring incoming email token can let a holder commit code with a user’s permissions and trigger CI/CD jobs.

Ruby patched three Onigmo regex bugs that enabled code execution in GitLab when it compiled attacker-controlled patterns.

One bug linked a stranger to an existing LDAP account through an email lookup nobody sanitized. The other let an unauthenticated user rewrite the map clients trust to find the identity provider. Same ...

A long-lived token embedded in GitLab’s issue-creating email address means anyone with the address, not just the project owner, can push code and trigger CI/CD jobs subject to the account’s existing ...

GitLab has released security updates to address multiple vulnerabilities in the company's DevSecOps platform, including ones enabling attackers to take over accounts and inject malicious jobs in ...

GitLab said it resolved CI/CD failures and slower interface performance affecting a limited number of GitLab.com customers after several days of intermittent platform disruptions.