Security readout for executives and security teams
Plain-English summary
A remote attacker can make a vulnerable GitLab server process an unsafe image and execute commands without credentials or user interaction. Successful exploitation can expose data, alter repositories or settings, and disrupt service. CISA lists this vulnerability as known exploited, making exposed, unpatched systems an urgent compromise risk.
Executive priority
Treat this as an immediate remediation and incident-review priority. Identify vulnerable GitLab systems, prioritize externally reachable instances, upgrade them, and investigate for prior compromise. The combination of unauthenticated remote command execution, maximum CVSS severity, and confirmed exploitation creates material risks to source code, credentials, software delivery, and service availability.
Technical view
CVE-2021-22205 is a CWE-94 remote command execution flaw caused by inadequate validation of images passed to a file parser. It affects GitLab CE/EE 11.9 through versions before 13.8.8, 13.9.6, and 13.10.3. Its CVSS 3.1 score is 10.0, with network access, low complexity, no privileges, and no user interaction required.
Likely exposure
Self-managed GitLab CE/EE instances within the affected version ranges are exposed. Internet-reachable instances deserve immediate attention because the CVSS vector indicates network exploitation without authentication or user interaction. The supplied evidence does not identify affected hosted services, specific deployments, or configuration-dependent exceptions.
Exploitation context
CISA's Known Exploited Vulnerabilities catalog confirms exploitation in the wild. The bundle does not establish whether exploitation is currently widespread, identify particular threat actors, or provide campaign details. Because exploitation requires neither credentials nor user interaction, vulnerable reachable instances should be treated as possible compromise candidates.
Researcher notes
The evidence supports unauthenticated, network-reachable command execution through unsafe image parsing. It does not specify reliable compromise indicators, affected parser components, attacker persistence methods, or vendor-approved interim controls. Validation should therefore combine exact version assessment with environment-specific telemetry review and current GitLab guidance.
Mitigation direction
- Upgrade affected branches to at least 13.8.8, 13.9.6, or 13.10.3, as applicable.
- Prefer a currently supported GitLab release after reviewing GitLab's current upgrade guidance.
- If upgrading is delayed, obtain vendor-approved interim guidance; the supplied bundle names no alternative mitigation.
- Investigate potentially exposed instances for compromise instead of assuming an upgrade removes prior attacker access.
Validation and detection
- Inventory every self-managed GitLab CE/EE instance and record its exact installed version.
- Identify versions from 11.9 through those preceding 13.8.8, 13.9.6, or 13.10.3 as affected.
- Confirm upgraded instances report a fixed or later supported version.
- Review GitLab, file-processing, and operating-system telemetry for unexpected command execution or suspicious image-processing activity.
- Document external reachability and unauthenticated access paths to prioritize investigation.
Public sources used
The source record changed after analysis: Material source record changed after analysis.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-94: Code execution behavior lookup
Code execution and unsafe deserialization weaknesses often justify reviewing execution behavior and process telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-22205 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 10 (3.1)
- Known Exploited
- Yes
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CISA KEV status
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H3.96GitLabVulnerability scoring details
Base CVSS 3.1 score
10CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- Added to KEVCISA-ADP
CISA Known Exploited Vulnerabilities metadata lists this CVE as known exploited.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://hackerone.com/reports/1154542CVE reference, GitLab · x_refsource_MISC
- https://gitlab.com/gitlab-org/gitlab/-/issues/327121CVE reference, GitLab · x_refsource_MISC
- https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22205.jsonCVE reference, GitLab · x_refsource_CONFIRM
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22205CVE reference, CISA-ADP · government-resource
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Control of Generation of Code ('Code Injection')
Improper Control of Generation of Code ('Code Injection') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.