CVE-2024-4099

See a problem?
Please try reporting it to the source first.

Source

https://nvd.nist.gov/vuln/detail/CVE-2024-4099

Import Source

https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-4099.json

JSON Data

https://api.test.osv.dev/v1/vulns/CVE-2024-4099

Published

2024-09-26T23:02:15.810Z

Modified

2025-12-01T06:30:58.831812Z

Severity

3.1 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N CVSS Calculator

Summary

Improper Encoding or Escaping of Output in GitLab

Details

An issue has been discovered in GitLab EE affecting all versions starting from 16.0 prior to 17.2.8, from 17.3 prior to 17.3.4, and from 17.4 prior to 17.4.1. An AI feature was found to read unsanitized content in a way that could have allowed an attacker to hide prompt injection.

Database specific

{
    "cna_assigner": "GitLab",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/4xxx/CVE-2024-4099.json",
    "cwe_ids": [
        "CWE-116"
    ]
}

References

Affected packages

Git / gitlab.com/gitlab-org/gitlab

Affected ranges

Type

GIT

Repo

https://gitlab.com/gitlab-org/gitlab

Events

Introduced

280a09dbca836a6eedf5da1e63953fe8da44bf4c

Fixed

b47f3914f1bcce3bc77e64c310363fa218788ffd

Database specific

{
    "versions": [
        {
            "introduced": "16.0"
        },
        {
            "fixed": "17.2.8"
        }
    ]
}

Type

GIT

Repo

https://gitlab.com/gitlab-org/gitlab

Events

Introduced

5aad128b1defa01641e69fdcd5a2ec16bd1d4c2c

Fixed

e5c34c00f7d566d52c12fa37f8688861f153b579

Database specific

{
    "versions": [
        {
            "introduced": "17.3"
        },
        {
            "fixed": "17.3.4"
        }
    ]
}

Type

GIT

Repo

https://gitlab.com/gitlab-org/gitlab

Events

Introduced

22193b3da887c1fa5e49021fa8f87b74e6539a7a

Fixed

40bdc966046ddc890715ea16e1e10420f7daea19

Database specific

{
    "versions": [
        {
            "introduced": "17.4"
        },
        {
            "fixed": "17.4.1"
        }
    ]
}

Affected versions

v17.*

v17.3.0-ee

v17.3.1-ee

v17.3.2-ee

v17.3.3-ee

v17.3.4-rc50-ee

v17.4.0-ee

v17.4.1-rc10-ee

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-4099.json"