{"data":{"id":"4a577249-3a47-45a1-886c-2202bbc50953","title":"GHSA-5648-rgj9-v224: @zereight/mcp-gitlab has multiple safety-control bypasses: execute_graphql read-only + allow-list bypass, unauthenticated transports, session-exhaustion DoS","summary":"The @zereight/mcp-gitlab package (reviewed at commit 60adcc0de5b0e96c4c2029f7a25d2775946421d8, version 2.1.28) has five defects that defeat its safety controls: read-only mode, the GITLAB_ALLOWED_PROJECT_IDS allow-list, and transport auth. The execute_graphql tool is the most serious, since a document prefixed with a comma can execute a mutation while being classified as read-only, and the handler bypasses the project allow-list entirely. Other defects expose the /mcp and SSE transports without authentication and allow session-exhaustion denial of service.","solution":"N/A -- no mitigation discussed in source.","labels":["security","industry"],"sourceUrl":"https://github.com/advisories/GHSA-5648-rgj9-v224","publishedAt":"2026-09-15T20:48:22.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":"high","severity":"high","attackType":["prompt_injection","denial_of_service"],"issueType":"vulnerability","affectedPackages":["@zereight/mcp-gitlab@< 2.1.30 (fixed: 2.1.30)"],"affectedPackageNames":["@zereight/mcp-gitlab"],"affectedPackageRefs":["npm:@zereight/mcp-gitlab"],"affectedVendors":[],"affectedVendorsRaw":["@zereight/mcp-gitlab","GitLab","MCP"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":["GHSA-5648-rgj9-v224"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-09-15T20:48:22.000Z","fixReleasedAt":"2026-07-05T05:45:42.602Z","daysToFix":-72,"fixCheckedAt":"2026-10-29T21:30:36.867Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"agent","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":["AML.T0051"],"fixes":[{"ecosystem":"npm","name":"@zereight/mcp-gitlab","fixedVersion":"2.1.30","matchedVersion":"2.1.30","fixReleasedAt":"2026-07-05T05:45:42.602Z","daysToFix":-72,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:30:36.712Z"}]}}