GitLab npm Package Critical Vulnerability: CVE-2026-19478 Exploited
- Severity
- CRITICAL
- Affected component
- gitlab (npm)
- Patched version
- Not yet available
A critical vulnerability in the GitLab npm package, CVE-2026-19478, allows unauthenticated attackers to modify or delete public projects and user data. This vulnerability is currently being exploited in the wild.
What happened
CVE-2026-19478 is a code injection flaw that enables an unauthenticated attacker to alter or delete publicly accessible GitLab projects and their data without requiring credentials or user interaction. The vulnerability was first flagged on August 20, 2026, and confirmed on August 24, 2026. According to The Hacker News, the affected versions of GitLab Community Edition (CE) and Enterprise Edition (EE) include 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4. GitLab has released patches in versions 19.2.4, 19.1.6, 19.0.8, and 18.11.11.
The exploitation of this vulnerability occurs via a GraphQL directive. WatchTowr, a preemptive exposure management firm, reported that they were able to reproduce the vulnerability shortly after its disclosure and observed active exploitation against their honeypot network. Organizations are advised to review their web logs for signs of probes or attempted exploitation, specifically looking for requests containing '@gl_introduced'.
What to do about it
- Upgrade to a patched version of GitLab as soon as it becomes available.
- Review public projects for any unauthorized changes or modifications.
- Monitor web logs for requests containing '@gl_introduced' to detect potential exploitation attempts.
- Stay informed by consulting the primary sources for updates on the vulnerability and any additional patches.
How 0Day would have caught this
gitlab is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
If you are using GitLab Community Edition (CE) or Enterprise Edition (EE) versions 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, or 19.2 before 19.2.4, you are affected.
What should I do right now?
Upgrade to a patched version of GitLab (19.2.4, 19.1.6, 19.0.8, or 18.11.11) and review your public projects for unauthorized changes.
Has this been exploited in the wild?
Yes, CVE-2026-19478 is currently being exploited in the wild.