Security

Vendor-neutral coverage of security.

Articles

5 articles

GitLab's CVSS 10 fix lives in the CI config parser

GitLab released 19.4.2, 19.3.5 and 19.2.8 on 12 October to fix a CVSS 10.0 flaw in its CI/CD regular expression compiler that could let an unauthenticated user run code on the server. GitLab.com is already patched; self-managed instances need to upgrade.

Oct 13, 2026 · Tomás Vega Security

GitLab ships critical patch across 19.4, 19.3 and 19.2

GitLab published a cross-branch security patch on 23 September covering 19.4.1, 19.3.3 and 19.2.7, with fixes rated up to Critical and self-managed operators asked to upgrade as soon as possible.

Sep 29, 2026 · Maya Okonkwo Security

CodeQL 2.26.3 retunes its Actions queries and drops the self-hosted module

CodeQL 2.26.3 reworks how the engine reasons about GitHub Actions workflows, tightening output-clobbering, cache-poisoning and env-var injection queries and removing the self-hosted runner module. Hosted code scanning is already on the new pack, so the next full run may move alert counts in both directions.

Aug 23, 2026 · Maya Okonkwo Security

CodeQL 2.26.2 trims what counts as safe: fresh alerts incoming

GitHub's static analysis engine adds Swift 6.3.3 and Kotlin 2.4.10 support in CodeQL 2.26.2, and quietly removes a batch of sanitizers that used to make path injection and URL redirection findings disappear.

Aug 10, 2026 · Tomás Vega Security

actions/checkout v7 refuses fork PR code in pull_request_target

GitHub shipped actions/checkout v7, which fails by default when a workflow triggered by pull_request_target or workflow_run tries to fetch the head of a fork's pull request. Same-repo PRs and the standard pull_request event are unaffected; a deliberately conspicuous opt-out exists for teams who really mean it.

Jun 18, 2026 · Tomás Vega