CVE-2025-6945: 
GitLab vulnerability analysis and mitigation

GitLab has identified and remediated a prompt injection vulnerability (CVE-2025-6945) in GitLab Enterprise Edition (EE) affecting versions from 17.9 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2. The vulnerability could allow authenticated users to leak sensitive information from confidential issues through hidden prompt injection in merge request comments (GitLab Release, NVD).

The vulnerability has been assigned a CVSS v3.1 Base Score of 3.5 (Low) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N. This indicates that the vulnerability requires network access, low attack complexity, low privileges, and user interaction, with only confidentiality impact. The vulnerability is classified under CWE-77 (Improper Neutralization of Special Elements used in a Command) (GitLab Release, NVD).

The vulnerability allows authenticated attackers to potentially extract sensitive information from confidential issues by manipulating merge request comments with hidden prompts. The impact is limited to information disclosure with no direct impact on system integrity or availability (GitLab Release).

GitLab has released patches in versions 18.3.6, 18.4.4, and 18.5.2. Users are strongly recommended to upgrade to these patched versions immediately. GitLab.com has already been updated with the security fix, and GitLab Dedicated customers do not need to take any action (GitLab Release).