{"data":{"id":"798373fa-eb7a-424c-a3f3-dccf888c6689","title":"CVE-2026-18252: GitLab has remediated an issue in GitLab EE affecting all versions from 18.9 before 19.1.7, 19.2 before 19.2.5, and 19.3","summary":"GitLab EE (Enterprise Edition, a version of the GitLab code management platform with extra features) had a security flaw where authenticated users with developer-role permissions could run arbitrary commands (any code they wanted) in a CI context (continuous integration, the automated testing and deployment process) because a Claude agent was reading configuration from user-controlled sources without proper validation. GitLab has now fixed this issue.","solution":"Update to GitLab EE version 19.1.7, 19.2.5, or 19.3.1 or later, depending on which version you are currently running.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-18252","publishedAt":"2026-08-26T14:17:08.000Z","cveId":"CVE-2026-18252","cweIds":["CWE-829"],"cvssScore":"7.3","cvssSeverity":"high","severity":"high","attackType":["prompt_injection"],"issueType":"vulnerability","affectedPackages":null,"affectedVendors":["Anthropic"],"affectedVendorsRaw":["GitLab","Claude","Anthropic"],"classifierModel":"claude-haiku-4-5-20251001","classifierPromptVersion":"v3","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","attackVector":"network","attackComplexity":"low","privilegesRequired":"low","userInteraction":"required","exploitMaturity":"unknown","epssScore":0,"patchAvailable":null,"disclosureDate":"2026-08-26T14:17:08.000Z","capecIds":["CAPEC-437"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["integrity","confidentiality"],"aiComponentTargeted":"agent","llmSpecific":true,"classifierConfidence":0.92,"researchCategory":null,"atlasIds":["AML.T0051"]}}