CVE-2025-6945

LOW

GitLab 17.8-18.3.5, 18.4-18.4.3, 18.5-18.5.1 - Information Disclosure via Merge Request Comment Prompt Injection

Title source: llm
STIX 2.1

Description

GitLab has remediated an issue in GitLab EE affecting all versions from 17.8 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2 that could have allowed an authenticated attacker to leak sensitive information from confidential issues by injecting hidden prompts into merge request comments.

References (3)

Core 3
Core References
Broken Link issue-tracking permissions-required
https://gitlab.com/gitlab-org/gitlab/-/issues/552611
Permissions Required technical-description exploit permissions-required
https://hackerone.com/reports/3173458

Scores

CVSS v3 3.5
EPSS 0.0003
EPSS Percentile 7.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact total

Details

CWE
CWE-77
Status published
Products (1)
gitlab/gitlab 17.9.0 - 18.3.6
Published Nov 15, 2025
Tracked Since Feb 18, 2026