Home » Database

AVID-2026-R0046

Description

Improper Control of Generation of Code (‘Code Injection’) in GitLab (CVE-2025-2867)

Details

An issue has been discovered in the GitLab Duo with Amazon Q affecting all versions from 17.8 before 17.8.6, 17.9 before 17.9.3, and 17.10 before 17.10.1. A specifically crafted issue could manipulate AI-assisted development features to potentially expose sensitive project data to unauthorized users.

References

Affected or Relevant Artifacts

  • Developer: GitLab
  • Deployer: GitLab
  • Artifact Details:
TypeName
SystemGitLab

Impact

AVID Taxonomy Categorization

  • Risk domains: Security
  • SEP subcategories: S0100: Software Vulnerability
  • Lifecycle stages: L06: Deployment

CVSS

Version3.1
Vector StringCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N
Base Score4.4
Base Severity🟠 Medium
Attack VectorNETWORK
Attack Complexity🔴 High
Privileges Required🟢 Low
User InteractionREQUIRED
ScopeCHANGED
Confidentiality Impact🟢 Low
Integrity Impact🟢 Low
Availability ImpactNONE

CWE

IDDescription
CWE-94CWE-94: Improper Control of Generation of Code (‘Code Injection’)

Other information

  • Report Type: Advisory
  • Credits:
  • Date Reported: 2025-03-27
  • Version: 0.3.1
  • AVID Entry