All articles tagged with #gitlab
GitLab released emergency patches on October 8 for a maximum-severity vulnerability (CVE-2026-97229) in its CI/CD regular expression compiler. The flaw, rated 10.0 on the CVSS scale, allows unauthenticated attackers to execute arbitrary code via specially crafted regex inputs. Self-managed users must upgrade to versions 19.2.8, 19.3.4, or 19.4.2 immediately; cloud-hosted instances are already patched.
GitLab has released patches for CVE-2026-90970, a critical vulnerability in its AI Gateway service that allows authenticated users to execute arbitrary commands. The flaw, rated 9.9 on the CVSS scale, affects only self-hosted instances; GitLab-managed services are already secured. Users must update to versions 19.2.4, 19.3.2, or 19.4.1 immediately.
CISA has added a critical GitLab vulnerability to its Known Exploited Vulnerabilities list, mandating federal agencies patch within three days. The flaw, CVE-2026-85706, allows unauthenticated attackers to read sensitive files via a path traversal bug in the repository commits API. Security firm watchTowr confirmed active internet-wide probing within hours of disclosure, warning that mass exploitation is imminent. GitLab released patches for versions 19.3.2, 19.2.6, and 19.1.8, urging all self-hosted users to upgrade immediately to prevent credential theft and pipeline poisoning.
GitLab released emergency patches on September 10, 2026, to fix a maximum-severity path traversal vulnerability (CVE-2026-85706) in its repository commits API. The flaw, rated 10.0 on the CVSS scale, allows unauthenticated attackers to read arbitrary files, including credentials and secrets, from vulnerable servers. Security firm watchTowr reported that in-the-wild probes began within hours of disclosure. GitLab also patched a critical insecure deserialization flaw (CVE-2026-87719) in its Enterprise Edition. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the path traversal flaw to its Known Exploited Vulnerabilities catalog, mandating remediation by September 14. GitLab urged all self-managed users to upgrade to versions 19.3.2, 19.2.6, or 19.1.8 immediately, as GitLab.com and Dedicated customers are already protected.
GitLab released patches for a critical path-traversal flaw (CVE-2026-85706, CVSS 10) in the repository commits API that could let an unauthenticated attacker read arbitrary server files; in-the-wild probes were observed within hours of disclosure. The fixes also address a high-severity insecure deserialization issue in GitLab EE (CVE-2026-87719). Admins should upgrade to patched versions (CE/EE 19.1.8, 19.2.6, 19.3.2) or limit internet exposure, and monitor for suspicious POST requests to /api/v4/projects/{id}/repository/commits/ containing file.Path parameters to identify exploitation attempts.
While big tech dominates AI headlines, smaller stocks like SoundHound and GitLab show strong potential for outperformance due to their innovative approaches and growth strategies, with SoundHound focusing on voice AI and GitLab on AI-driven software development tools.
Stock futures declined after limited trade agreement details between the US and China, with notable movements in stocks like GitLab, GameStop, Tesla, and others. GitLab beat earnings expectations but issued cautious guidance, leading to a stock drop. Tesla's shares rose on autonomous vehicle developments, while GameStop reported a profit reversal but saw a stock decline. Other companies like Chewy, SailPoint, and Dave & Buster's reported mixed earnings, influencing their stock movements. Oracle is set to release earnings after hours.
Alphabet's venture capital fund, CapitalG, has significantly increased its investments in GitLab and Prime Medicine. GitLab, a code repository management platform, saw Alphabet boost its stake by 269%, making it Alphabet's largest public holding. Prime Medicine, a biotech company focused on gene-editing therapies, had its share count increased by 27%. Both investments are considered risky but have potential for high returns.
GitLab has patched a high-severity XSS vulnerability (CVE-2024-4835) in its VS code editor that could allow unauthenticated attackers to take over user accounts. The company urges immediate updates to versions 17.0.1, 16.11.3, and 16.10.6 for both Community and Enterprise Editions. Additionally, six medium-severity flaws were also addressed, including a CSRF vulnerability and a denial-of-service bug. GitLab accounts are high-value targets due to the sensitive data they host, and previous vulnerabilities have been actively exploited.
GitLab has confirmed the removal of Suyu, a new Nintendo Switch emulator, due to concerns about online harassment and lack of moderation on the platform. Users have expressed frustration over the site's failure to address misogynistic, transphobic, and harassing comments on emulation articles, leading to a decline in engagement and trust in the platform.
Suyu, a fork of the popular Nintendo Switch emulator Yuzu, was taken down from GitLab due to a DMCA takedown notice, likely issued by Nintendo. The project had just released its first build, including various fixes and changes, but now faces uncertainty about its future. The team has moved the repository to a new address, but it remains to be seen if this will allow the project to continue. Meanwhile, the other major Nintendo Switch emulator, Ryujinx, remains unaffected by DMCA takedowns.
GitLab has removed the Suyu fork of the Nintendo Switch emulator Yuzu and disabled the accounts of its developers after receiving a DMCA takedown request, although it's unclear if Nintendo is behind it. The request alleges that Suyu violated DMCA 1201 by circumventing Nintendo's technical protection measures, but Suyu claims it doesn't include the same measures as Yuzu. GitLab's response raises questions about its account disabling policy and the handling of DMCA takedown requests. Suyu has indicated it will be hosted elsewhere after being removed from GitLab.
GitLab's shares dropped 16% after the company forecasted full-year 2025 revenue and profit below Wall Street estimates, citing a cautious spending environment due to an uncertain economy. The company's CFO expects a "less conservative" approach to forecasts as it enters its third year as a public firm. Despite stable growth predictions, the stock is set to lose about $1.9 billion from its market value. GitLab's revenue projections for the first quarter and fiscal year 2025 fell below analysts' expectations, with the company warning that the projection does not include a potential price hike.
Stitch Fix shares slide after missing revenue estimates and reporting wider losses, ThredUp stock dips despite beating revenue estimates, and GitLab plunges in extended hours trading despite topping fourth-quarter earnings estimates, as its full-year guidance falls short of analysts' expectations.
GitLab has issued security updates for its Community and Enterprise Editions to address critical vulnerabilities, including a zero-click account hijacking flaw (CVE-2023-7028) that allows attackers to take over accounts without user interaction. The flaw affects versions 16.1 to 16.7 and could lead to the compromise of proprietary code and sensitive data. Other vulnerabilities include the abuse of Slack/Mattermost integrations and bypassing CODEOWNERS approval. Users are strongly advised to update their installations as soon as possible.