{"api_version":"1","generated_at":"2026-08-05T17:59:33+00:00","cve":"CVE-2026-15077","urls":{"html":"https://cve.report/CVE-2026-15077","api":"https://cve.report/api/cve/CVE-2026-15077.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-15077","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-15077"},"summary":{"title":"Improper Neutralization of Input Used for LLM Prompting in GitLab","description":"GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.3 and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user to access information from unauthorized projects due to improper neutralization of untrusted content processed by the AI-assisted code review functionality.","state":"PUBLISHED","assigner":"GitLab","published_at":"2026-07-29 20:17:01","updated_at":"2026-08-03 13:26:04"},"problem_types":["CWE-74","CWE-1427 CWE-1427: Improper Neutralization of Input Used for LLM Prompting"],"metrics":[{"version":"3.1","source":"cve@gitlab.com","type":"Secondary","score":"4.3","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"4.3","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","data":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"}}],"references":[{"url":"https://gitlab.com/gitlab-org/gitlab/-/work_items/601482","name":"https://gitlab.com/gitlab-org/gitlab/-/work_items/601482","refsource":"cve@gitlab.com","tags":["Broken Link"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-1-released/","name":"https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-1-released/","refsource":"cve@gitlab.com","tags":["Release Notes","Vendor Advisory"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-15077","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15077","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"GitLab","product":"GitLab","version":"affected 19.1 19.1.3 semver","platforms":[]},{"source":"CNA","vendor":"GitLab","product":"GitLab","version":"affected 19.2 19.2.1 semver","platforms":[]}],"timeline":[],"solutions":[{"source":"CNA","title":"","value":"Upgrade to versions 19.1.3, 19.2.1 or above.","time":"","lang":"en"}],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"This vulnerability has been discovered internally by GitLab team member Mike Wronski","lang":"en"}],"nvd_cpes":[{"cve_year":"2026","cve_id":"15077","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"gitlab","cpe5":"gitlab","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"enterprise","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2026","cve_id":"15077","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"gitlab","cpe5":"gitlab","cpe6":"19.2.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"enterprise","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"15077","cve":"CVE-2026-15077","epss":"0.002500000","percentile":"0.164720000","score_date":"2026-08-04","updated_at":"2026-08-05 00:03:14"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-15077","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-07-29T19:33:13.987893Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-07-29T19:33:20.717Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"cpes":["cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"GitLab","repo":"git://git@gitlab.com:gitlab-org/gitlab.git","vendor":"GitLab","versions":[{"lessThan":"19.1.3","status":"affected","version":"19.1","versionType":"semver"},{"lessThan":"19.2.1","status":"affected","version":"19.2","versionType":"semver"}]}],"credits":[{"lang":"en","type":"finder","value":"This vulnerability has been discovered internally by GitLab team member Mike Wronski"}],"descriptions":[{"lang":"en","value":"GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.3 and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user to access information from unauthorized projects due to improper neutralization of untrusted content processed by the AI-assisted code review functionality."}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-1427","description":"CWE-1427: Improper Neutralization of Input Used for LLM Prompting","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-07-29T19:00:11.047Z","orgId":"ceab7361-8a18-47b1-92ba-4d7d25f6715a","shortName":"GitLab"},"references":[{"url":"https://gitlab.com/gitlab-org/gitlab/-/work_items/601482"},{"url":"https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-1-released/"}],"solutions":[{"lang":"en","value":"Upgrade to versions 19.1.3, 19.2.1 or above."}],"title":"Improper Neutralization of Input Used for LLM Prompting in GitLab"}},"cveMetadata":{"assignerOrgId":"ceab7361-8a18-47b1-92ba-4d7d25f6715a","assignerShortName":"GitLab","cveId":"CVE-2026-15077","datePublished":"2026-07-29T19:00:11.047Z","dateReserved":"2026-07-08T15:36:58.778Z","dateUpdated":"2026-07-29T19:33:20.717Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-07-29 20:17:01","lastModifiedDate":"2026-08-03 13:26:04","problem_types":["CWE-74","CWE-1427 CWE-1427: Improper Neutralization of Input Used for LLM Prompting"],"metrics":{"cvssMetricV31":[{"source":"cve@gitlab.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-07-29T19:33:13.987893Z","id":"CVE-2026-15077","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"19.1.0","versionEndExcluding":"19.1.3","matchCriteriaId":"02C7C8D4-9DFC-42F5-9E73-C2E81B2A7C3C"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:19.2.0:*:*:*:enterprise:*:*:*","matchCriteriaId":"2BA0ECDA-CCC7-41A9-8FFD-3557AE49F9B2"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"15077","Ordinal":"1","Title":"Improper Neutralization of Input Used for LLM Prompting in GitLa","CVE":"CVE-2026-15077","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"15077","Ordinal":"1","NoteData":"GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.3 and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user to access information from unauthorized projects due to improper neutralization of untrusted content processed by the AI-assisted code review functionality.","Type":"Description","Title":"Improper Neutralization of Input Used for LLM Prompting in GitLa"}]}}}