CVE-2026-19478: Improper Control of Generation of Code ('Code Injection') in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could allow an unauthenticated user to remotely modify or delete public projects and user data via a GraphQL directive.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 18.11.11 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 19.0.8 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 19.1.6 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 19.2.4
Event History
Frequently Asked Questions
What is the severity of CVE-2026-19478?
The severity of CVE-2026-19478 is rated as critical, with a CVSS score of 9.4.
What is CVE-2026-19478 about?
CVE-2026-19478 involves improper control of the generation of code resulting in code injection vulnerabilities in GitLab.
How do I fix CVE-2026-19478?
To fix CVE-2026-19478, upgrade GitLab to the latest version, specifically version 18.11.11 or later for 18.2 versions, and versions 19.0.8, 19.1.6, and 19.2.4 or later.
Who is affected by CVE-2026-19478?
CVE-2026-19478 affects all versions of GitLab CE/EE from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4.
What could happen if CVE-2026-19478 is exploited?
If exploited, CVE-2026-19478 could allow an unauthenticated user to remotely modify or delete public projects and user data.