Database/Control plane, storage & DevOps
GitLab EE: injected AI conversation context causes agent commands to run as another user
Impact
An authenticated GitLab user can plant crafted content that GitLab's AI agent later folds into its conversation context without neutralizing special elements, so agent-driven command execution can be attributed to a different user. Where GitLab is the CI/CD control plane for a GPU fleet, agent actions carry pipeline and repository privileges - the path from injected text to a job that runs on build or GPU runners is the thing to worry about, not the chat output itself. GitLab's note is deliberately brief; the exact reachable command surface is not detailed in the record, and the score (confidentiality and integrity high, availability none, user interaction required) is all that is established.
Who can reach it
Any authenticated GitLab user who can write content that lands in another user's AI conversation context. Victim interaction with the AI feature is required.
What to do
Upgrade GitLab EE to 19.2.8, 19.3.5 or 19.4.2 and restart the application - a GitLab-side upgrade, no fleet maintenance window. If the upgrade cannot be scheduled immediately, consider disabling AI agent features for untrusted-contributor projects.
References
Related entries
- HPE iLO4 / iLO5: Remote code execution on the management controllerCVE-2018-7078 · HPE iLO4 / iLO5High
- HPE iLO3/4/5: Arbitrary code execution on the iLOCVE-2018-7105 · HPE iLO3/4/5High
- NetApp ONTAP Select Deploy administration utility (privilege escalation): An administrative user of the Deploy utilityCVE-2019-17272 · NetApp ONTAP Select Deploy administration utility (privilege escalation)High
- Ceph MON (CephX authentication): The monitor does not sanitize other_keys when handling CEPHX_GET_AUTH_SESSION_KEY, soCVE-2021-20288 · Ceph MON (CephX authentication)High
- AMD PSP1 Configuration Block (APCB) parsing: An out-of-bounds memory write while the platform processes the AMD PSP1CVE-2021-26344 · AMD PSP1 Configuration Block (APCB) parsingHigh
- Schneider Electric StruxureWare Data Center Expert (V7.9.2 and prior) - network settings endpoint: Code injectionCVE-2023-25549 · Schneider Electric StruxureWare Data Center Expert (V7.9.2 and prior) - network settings endpointHigh
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.