Summary
generated automatically from NVD dataGitLab CE/EE contains a flaw in its Import from GitHub API endpoint, classified as CWE-78 (OS command injection). An authenticated user can abuse it to achieve remote code execution on the server. The issue affects versions from 11.3.4 before 15.1.5, 15.2 before 15.2.3, and 15.3 before 15.3.1, and it is rated CRITICAL with a CVSS v3.1 score of 9.9.
NVD description
A vulnerability in GitLab CE/EE affecting all versions from 11.3.4 prior to 15.1.5, 15.2 to 15.2.3, 15.3 to 15.3 to 15.3.1 allows an an authenticated user to achieve remote code execution via the Import from GitHub API endpoint
EPSS · FIRST.org
75.7%probability of exploitation in the next 30 days
Higher than 99% of scored CVEs
EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-19, recomputed daily by FIRST.org.
CVSS v3.1 Score
Information
- Published
- 17 oct. 2022
- Updated
- 17 juin 2026
- Status
- Modified
- Source
- cve@gitlab.com
Affected products
Weaknesses (CWE)
References (8)
- https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2884.jsonThird Party Advisory
- https://gitlab.com/gitlab-org/gitlab/-/issues/371098Third Party Advisory
- https://hackerone.com/reports/1672388Permissions RequiredThird Party Advisory
- https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2884.jsonThird Party Advisory
- https://gitlab.com/gitlab-org/gitlab/-/issues/371098Third Party Advisory
- https://hackerone.com/reports/1672388Permissions RequiredThird Party Advisory
Similar CVEs
Other vulnerabilities of type CWE-78
Monitor your products
Get automatic alerts for every new CVE affecting your equipment.