Improper Validation of Generative AI Output in GitLab Enterprise Edition and Gitlab Community Edition - CVE-2025-6945
Published: November 13, 2025
Vulnerability identifier: #VU118467
CSH Severity: Medium
CVSS v4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-6945
CWE-ID: CWE-1426
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to the prompt injection issue in GitLab Duo review. A remote user can inject hidden prompts in merge request comments and leak sensitive information from confidential issues.
Affected software
GitLab Enterprise Edition
Gitlab Community Edition
Gitlab Community Edition
How to mitigate CVE-2025-6945
Install updates from vendor's website.
GitLab Enterprise Edition - addressed in versions 18.3.6, 18.4.4, 18.5.2
Gitlab Community Edition - addressed in versions 18.3.6, 18.4.4, 18.5.2
Gitlab Community Edition - addressed in versions 18.3.6, 18.4.4, 18.5.2