GitLab has remediated an issue in GitLab EE affecting all versions from 17.8 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2 that could have allowed an authenticated attacker to leak sensitive information from confidential issues by injecting hidden prompts into merge request comments.
References
| Link | Resource |
|---|---|
| https://about.gitlab.com/releases/2025/11/12/patch-release-gitlab-18-5-2-released/ | Release Notes Vendor Advisory |
| https://gitlab.com/gitlab-org/gitlab/-/issues/552611 | Broken Link |
| https://hackerone.com/reports/3173458 | Permissions Required |
Configurations
Configuration 1 (hide)
|
History
20 Nov 2025, 21:07
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://about.gitlab.com/releases/2025/11/12/patch-release-gitlab-18-5-2-released/ - Release Notes, Vendor Advisory | |
| References | () https://gitlab.com/gitlab-org/gitlab/-/issues/552611 - Broken Link | |
| References | () https://hackerone.com/reports/3173458 - Permissions Required | |
| First Time |
Gitlab
Gitlab gitlab |
|
| CPE | cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:* |
15 Nov 2025, 08:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-11-15 08:15
Updated : 2025-11-20 21:07
NVD link : CVE-2025-6945
Mitre link : CVE-2025-6945
CVE.ORG link : CVE-2025-6945
JSON object : View
Products Affected
gitlab
- gitlab
CWE
CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')