CVE-2023-5226

Improper Control of Generation of Code ('Code Injection') in GitLab

An issue has been discovered in GitLab affecting all versions before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. Under certain circumstances, a malicious actor bypass prohibited branch checks using a specially crafted branch name to manipulate repository content in the UI.

Affected

GitLab

CVSS v3.1 NVD

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CVSS v3.1 GITLAB

4.8 MEDIUMCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N

EPSS

0.55% chance of exploitation in the next 30 days, 45th percentile

Published

2023-12-01

Updated

2026-08-14

Proof-of-concept exploits (1)

• https://hackerone.com/reports/2173053

Security advisories

• https://gitlab.com/gitlab-org/gitlab/-/issues/426400

References

• CVE Record
• NVD entry