CVE-2026-19478CWE-94code-injection

CVE-2026-19478

Critical · published August 18, 2026

Patch now

High probability of exploitation

CVSS calls it critical at 9.4. It sits in the 99.1th percentile for exploit probability.

CVSS v3.1
9.4
EPSS
60%
Percentile
99.1
In the wild
Unconfirmed
What it is

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could allow an unauthenticated user to remotely modify or delete public projects and user data via a GraphQL directive.

The record
Technical detail
CVSS v3.1
9.4 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.60204 · 99.1th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-08-18T00:16Z
Affected products (8)
ProductVersionsFixed in
gitlab/gitlab≥ 18.2.0, < 18.11.1118.11.11
gitlab/gitlab≥ 18.2.0, < 18.11.1118.11.11
gitlab/gitlab≥ 19.0.0, < 19.0.819.0.8
gitlab/gitlab≥ 19.0.0, < 19.0.819.0.8
gitlab/gitlab≥ 19.1.0, < 19.1.619.1.6
gitlab/gitlab≥ 19.1.0, < 19.1.619.1.6
gitlab/gitlab≥ 19.2.0, < 19.2.419.2.4
gitlab/gitlab≥ 19.2.0, < 19.2.419.2.4
References (3)
https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-4-released/ · [email protected]https://gitlab.com/gitlab-org/gitlab/-/work_items/611377 · [email protected]https://hackerone.com/reports/3926431 · [email protected]
EPSS history
Timeline
  • 25 SEP 03:24Z
    EPSS moved 6% → 60%
    epss
  • 17 AUG 20:04Z
    Improper Control of Generation of Code ('Code Injection') in GitLab
    cvelistv5