CVE-2024-7110

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2024-7110
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-7110.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-7110
Aliases
Downstream
Published
2024-08-22T15:30:47.474Z
Modified
2025-12-02T02:37:42.412980Z
Severity
  • 6.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N CVSS Calculator
Summary
Improper Neutralization of Special Elements used in a Command ('Command Injection') in GitLab
Details

An issue was discovered in GitLab EE affecting all versions starting 17.0 to 17.1.6, 17.2 prior to 17.2.4, and 17.3 prior to 17.3.1 allows an attacker to execute arbitrary command in a victim's pipeline through prompt injection.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/7xxx/CVE-2024-7110.json",
    "cwe_ids": [
        "CWE-77"
    ],
    "cna_assigner": "GitLab"
}
References

Affected packages

Git / gitlab.com/gitlab-org/gitlab

Affected ranges

Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
b7514f9c21c09a9ed2b258f5cfdd56c88f43864a
Fixed
668f9811406b9870ad522cb835a2ced5a12c0780
Database specific 
{
    "versions": [
        {
            "introduced": "17.1"
        },
        {
            "fixed": "17.1.6"
        }
    ]
}
Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
f1ebbe522423b514610449d0f6dc7a262f855314
Fixed
2c8b5432e8b6cbec3e12a9c1b5cb5567aa422b3c
Database specific 
{
    "versions": [
        {
            "introduced": "17.2"
        },
        {
            "fixed": "17.2.4"
        }
    ]
}
Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
5aad128b1defa01641e69fdcd5a2ec16bd1d4c2c
Fixed
df01858216e720acb4491a69a3bc6227a1f6ae1e
Database specific 
{
    "versions": [
        {
            "introduced": "17.3"
        },
        {
            "fixed": "17.3.1"
        }
    ]
}

Affected versions

v17.*

v17.1.0-ee
v17.1.1-ee
v17.1.2-ee
v17.1.3-ee
v17.1.4-ee
v17.2.0-ee
v17.2.1-ee
v17.2.2-ee
v17.3.0-ee

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-7110.json"