VendorsDev tools
GitLab
GitLab makes a DevSecOps platform for source control and CI/CD, offered as the GitLab.com service and as self-managed Community and Enterprise Editions.
- Response trend, 6 months
- Not enough history
- Open now
- None
- Latest incident
- 10 Sep 2026
- Incidents on record
- 3
Response to exploited bugs
Not rated. No reviewed zero-days yet.
Fixing privately reported bugs
Not rated. 1 private report on record. A grade needs at least 3.
What a grade means. B means the vendor met the public norm, such as a first fix within 7 days of the first public report or a private fix within 120 days. Taking half the norm time scores 92, an A. Taking twice the norm time scores 43, a D−. How grades work
Why these grades
Every clock starts at the first public report.
- Response to exploited bugs: not rated. No reviewed exploited zero-days in the last 36 months, so this grade does not apply yet.
- Fixing privately reported bugs: not rated, a grade needs 3 cases. Median 231 days from private report to the vendor's fix (1 case). 1 of 1 took longer than ZDI's 120-day deadline.
- 1 of 1 reviewed exploited bug had a public fix before exploitation was reported. It does not count toward the response grade.
- NR (not rated) means a subject has fewer than 3 data points from the last 36 months, or their recency weights add up to less than one current data point. For response, a data point is a reviewed exploited zero-day. For private fixes, it is a private report (one vendor, one report date). KEV listings alone never rate a vendor. A grade is provisional when the vendor's own evidence does not yet outweigh the starting value, or confidence is below medium.
Response to exploited bugs: sub-scores
- Time to first advisoryNo reviewed zero-days in the last 36 monthsNR0 cases, not used
- Time to first fixNo reviewed zero-days in the last 36 monthsNR0 cases, not used
- Time to fix all versionsNo reviewed zero-days in the last 36 monthsNR0 cases, not used
- OpennessAdvisories available by RSS624 cases, low confidence, not used for this vendor
Fixing privately reported bugs: sub-score
- Private fix speedMedian 231 days from private report to the vendor's fix (1 case)741 case, low confidence, not used for this vendor
Response fingerprint
Counts toward the response grade 0
No incidents count toward the grade yet.
Not graded 3: n-days, unreviewed timelines and end-of-life products
- 10 Sep 2026GitLab CE/EE path traversal in repository commits API (critical patch release 19.3.2, 19.2.6, 19.1.8)Not graded: n-day
- 6 Dec 2021GitLab CI Lint API server-side request forgery by unauthorized external users (2021)Not graded: n-day
- 11 Feb 2021GitLab unauthenticated server-side request forgery via webhooks / CI lint API (2021)Not graded: n-day
- Vendor silent
- Vendor statement, no fix
- Fixed for some versions
- Open, no fix
- Open, partly fixed
- Fixed when disclosed
- Date only, no time of day
One row per exploited incident, newest first. A tick at the start means a fix existed when the bug went public.
Exploited incidents
3 in 24 months, 0 with known ransomware use, 0% exploited before a fix
| First report | Incident | CVSS | Silence | First fix | All fixed | Status | Grade |
|---|---|---|---|---|---|---|---|
| 10 Sep 2026 | GitLab CE/EE path traversal in repository commits API (critical patch release 19.3.2, 19.2.6, 19.1.8)CVE-2026-85706 | 10.0 | same day | same day | same day | Fixed | Not graded: n-day |
| 6 Dec 2021 | GitLab CI Lint API server-side request forgery by unauthorized external users (2021)CVE-2021-39935 | 6.8 | same day | same day | same day | Fixed | Not graded: n-day |
| 11 Feb 2021 | GitLab unauthenticated server-side request forgery via webhooks / CI lint API (2021)CVE-2021-22175 | 6.8 | same day | same day | same day | Fixed | Not graded: n-day |
Private reports
Median 231 days, 100% over 120 days, 0 published unpatched
Bugs reported privately to GitLab by ZDI or Project Zero.
| Published | Advisory | Product | Days from report to fix or to publication. Tick: ZDI's 120-day deadline. | Patch at publication |
|---|---|---|---|---|
| 1 Apr 2024 | ZDI-24-358CVE-2024-2818 | GitLab | 231to vendor fix, 27 Mar 2024 | Yes |
Grade history
Response to exploited bugs: score at the end of each month.
Not rated at any point in this period.
Channels
Get GitLab's own alerts
- EmailGitLab security noticesSign up for the vendor’s security notification emails.
- RSSGitLab patch releases (Atom)Add the advisory feed to a feed reader or chat integration.
- GitHubGitLab CVE assignments repositoryWatch the repository for security advisories.
- BlueskyGitLab on BlueskyFollow the account.
What we watch
- RSSGitLab patch releases (Atom)
- BlueskyGitLab on Bluesky
See sources and health for when each was last read.
Grade not rated.