[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"focus:gitlab-patches-critical-code-injection-vulnerability-msyuuw17":3},{"item":4},{"id":5,"title":6,"slug":7,"summary":8,"severity":9,"category":10,"cve_ids":11,"affected_products":14,"action_required":18,"article_ids":19,"ioc_summary":21,"source_urls":22,"status":24,"expires_at":25,"created_at":26,"updated_at":27,"articles":28},"8e4fc2f8-bd28-4cd6-bfff-3a4cec8e1611","GitLab Patches Critical Code Injection Vulnerability","gitlab-patches-critical-code-injection-vulnerability-msyuuw17","GitLab released patches for a critical unauthenticated code injection vulnerability (CVE-2026-19478, CVSS 9.4) in GraphQL directives that allows attackers to modify or delete user data and public projects. A secondary CSRF flaw (CVE-2026-19650) affects the GraphQL multiplex query handler. Versions 18.2 through 19.2 are vulnerable and require immediate patching.","critical","advisory",[12,13],"CVE-2026-19478","CVE-2026-19650",[15,16,17],"GitLab","GitLab Community Edition","GitLab Enterprise Edition","Identify all GitLab CE\u002FEE instances running versions 18.2-19.2 in your environment and upgrade immediately to 18.11.11, 19.0.8, 19.1.6, or 19.2.4. Monitor GitLab API logs for suspicious GraphQL directive activity and unauthenticated data modification attempts targeting projects and user accounts.",[20],"c41ad168-4d5a-4402-9eef-01403ebc7469",null,[23],"https:\u002F\u002Fwww.securityweek.com\u002Fgitlab-patches-critical-code-injection-vulnerability\u002F","archived","2026-08-20T16:06:31.774+00:00","2026-08-18T16:06:35.256848+00:00","2026-08-20T17:05:38.489962+00:00",[29],{"id":20,"title":6,"url":23}]