Read the docs
TI-2022-02076 Aliases CVE-2022-2251GHSA-cxfq-cc8j-j2pp

OS command injection in GitLab Runner

Priority LOW 39CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-78.

Summary

Improper sanitization of branch names in GitLab Runner affecting all versions prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows a user who creates a branch with a specially crafted name and gets another user to trigger a pipeline to execute commands in the runner as that other user.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01177 67th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed GitLab Runner (GitLab): 15.3.5, 15.4.4, 15.5.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
GitLabGitLab Runnerbefore 15.3.5; 15.4 to before 15.4.4; 15.5 to before 15.5.215.3.5, 15.4.4, 15.5.2Patch availableCNA
  • GitLab Runner VendorGitLab Affected before 15.3.5; 15.4 to before 15.4.4; 15.5 to before 15.5.2 Fixed in 15.3.5, 15.4.4, 15.5.2 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:gitlab:runner:*:*:*:*:*:*:*:*before 15.3.5; 15.4.0 to before 15.4.4; 15.5.0 to before 15.5.2VulnerableGitLab
  • cpe:2.3:a:gitlab:runner:*:*:*:*:*:*:*:* Versions before 15.3.5; 15.4.0 to before 15.4.4; 15.5.0 to before 15.5.2 Vulnerable ·GitLab

Remediation

  • Fix · CNA GitLab Runner (GitLab) Fixed in 15.3.5, 15.4.4, 15.5.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-2251
  2. 2026-10-03 Alias added: GHSA-cxfq-cc8j-j2pp

References

Exploit 1

Advisory 2

  • TI-2020-10420 Server-side request forgery in GitLab Runner CVSS 3.1HIGH 8.8
  • TI-2020-10452 An issue has been discovered in GitLab Runner affecting all versions starting from 13.4.0… CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences