Improper Input Validation in GitLab Runner

CVE-2022-2251

Summary

The security flaw in GitLab Runner arises from inadequate sanitization of branch names, which may allow an attacker to create a branch with a carefully crafted name. If another user subsequently triggers a pipeline related to this branch, malicious commands could be executed within the context of that user's environment, leading to unauthorized actions. This vulnerability affects multiple versions of GitLab Runner and underscores the necessity of proper input validation mechanisms to mitigate such risks.

References