Multiple vulnerabilities in GitLab CE and EE
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
GitLab CE and EE versions prior to 18.10.8, 18.11.5, and 19.0.2 contain multiple vulnerabilities allowing RCE, DoS, SSRF, and XSS.
CERT-FR has published a security advisory covering multiple vulnerabilities affecting GitLab Community Edition and Enterprise Edition. The affected versions include all releases prior to 18.10.8, 18.11.x prior to 18.11.5, and 19.0.x prior to 19.0.2. The vulnerabilities enable remote code execution, denial of service, server-side request forgery (SSRF), security policy bypass, and cross-site scripting (XSS). Defenders using GitLab should prioritize patching to the fixed versions: 18.10.8 or later, 18.11.5 or later, or 19.0.2 or later. The advisory references a GitLab security bulletin released on 10 June 2026 with complete remediation details.
Mentioned in this report
Detection guidance
GitLab Application Process Spawning Shell With Download or Reverse-Shell Commands
GitLab embedded Ruby/Puma/Sidekiq/Workhorse processes spawning a shell that runs download-and-execute or reverse-shell commands, consistent with post-exploitation of a GitLab RCE flaw. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: GitLab Application Process Spawning Shell With Download or Reverse-Shell Commands
description: Detects a shell spawned by GitLab embedded application processes (ruby,
puma, sidekiq, workhorse under the Omnibus embedded directory) whose command line
contains download-and-execute or reverse-shell patterns. This is typical post-exploitation
behaviour after exploiting a remote code execution vulnerability in a public-facing
GitLab instance. The advisory gives no exploit specifics, so this rule targets the
resulting behaviour only.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|contains: /opt/gitlab/embedded/
selection_shell:
Image|endswith:
- /sh
- /bash
- /dash
selection_cmd:
CommandLine|contains:
- curl
- wget
- /dev/tcp/
- nc -e
- ncat
- base64 -d
- python -c
- perl -e
- mkfifo
condition: selection_parent and selection_shell and selection_cmd
falsepositives:
- Custom GitLab integrations or admin scripts that call curl or wget through a shell
from a Sidekiq job
- Health-check or maintenance hooks that shell out from GitLab Ruby processes
level: medium
id: 1d644e0b-eef7-512e-98b2-96982330c3b9
status: experimental
author: Vorant
references:
- https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0733
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0733
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,571 reports from 145 sources, 595 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs