GitLab GraphQL code injection vulnerability

By Editorial Team | August 27, 2026
A GitLab GraphQL code injection vulnerability (CVE-2026-19478, CVSS 9.4) was exploited within minutes of disclosure. What happened and how to patch now.

A GitLab GraphQL code injection vulnerability is now under active exploitation, reproduced and attacked within minutes of GitLab’s August 17, 2026 disclosure of CVE-2026-19478. The unauthenticated flaw (CVSS 9.4) lets an attacker delete public projects, forge fake fix records, or lock out maintainers on any unpatched self-managed GitLab instance. GitLab.com and GitLab Dedicated were already…

Read More

GitLab Oj Spill RCE Exploit Goes Public

By Editorial Team | July 28, 2026
GitLab Oj Spill RCE Exploit Goes Public

The GitLab Oj Spill RCE is now public: a working exploit chain and full technical writeup were released on July 24 for a remote-code-execution flaw that GitLab quietly patched six weeks earlier, on June 10. If your self-managed GitLab instance is still on 18.10.7 or older, any developer who can push a commit can now…

Read More