CVE-2026-19478
Improper Control of Generation of Code ('Code Injection') in GitLab
Description
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could allow an unauthenticated user to remotely modify or delete public projects and user data via a GraphQL directive.
No summary for this CVE yet.
CVSS Vector Breakdown
Exploitability
AV:NAttack VectorNetwork
AC:LAttack ComplexityLow
PR:NPrivileges RequiredNone
UI:NUser InteractionNone
Scope
S:UScopeUnchanged
Impact
C:LConfidentialityLow
I:HIntegrityHigh
A:HAvailabilityHigh
Weaknesses
Affected Products
GitLab
commercial·NLaka gitlab ce/ee
Exploitability
Official Patch Available
Attack Graph
Products CVE Techniques Tactics
Click technique nodes for MITRE ATT&CK details · drag to pan · Ctrl/⌘ + scroll to zoom, or go fullscreen.
MITRE ATT&CK
2 techniques Execution
Initial Access
References
News mentions
8- GitLab CVE-2026-19478 Comes Under Active Exploitation Within Days of Disclosureen·The Hacker News·
- Critical GitLab Flaw Exploited Shortly After Disclosureen-us·SecurityWeek· Exploited GitLab CE rce
- Критическая уязвимость в GitLab позволяла удалять общедоступные проектыru-ru·Хакер (xakep.ru)· Patch GitLab web-app
- Critical GitLab Zero-Click Flaw Poses Mitigation Challengesen·Dark Reading· Patch GitLab CE/EE rce
- Critical and High-Severity GraphQL CVEs in GitLab: Code Injection and CSRF via One Directiveen-us·OX Security· Patch GitLab CE/EE rce
- Critical GitLab flaw allows attackers to modify or delete public projects (CVE-2026-19478)en-us·Help Net Security· Patch GitLab CE/EE rce
- GitLab Patches Critical Code Injection Vulnerabilityen-us·SecurityWeek· Patch GitLab web-app
- Critical GitLab GraphQL Flaw Could Let Unauthenticated Attackers Delete Public Projectsen·The Hacker News· Patch GitLab CE web-app
Unlock Complete Vulnerability Intelligence
Get the full picture for CVE-2026-19478 and every CVE in our database. Create a free account — no credit card required.
Create Free AccountPlain-language analysis
Impact assessment and exploitation scenario in plain English
Attack graph visualization
Interactive attack path and kill chain mapping
Exploit details & PoC links
ExploitDB, Metasploit, GitHub PoCs with direct links
Nuclei scanner templates
Ready-to-use vulnerability scanner templates
Full remediation guide
Patch instructions, workarounds, and compliance impact
Interactive AI chat
Ask questions about this vulnerability in natural language
Related vulnerabilities
Semantically similar CVEs and attack patterns
REST API & MCP access
Integrate vulnerability data into your workflows