CVE-2019-14944

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-04-16 · updated 2026-06-17
Weakness: CWE-77

Description

An issue was discovered in GitLab Community and Enterprise Edition before 11.11.8, 12 before 12.0.6, and 12.1 before 12.1.6. Gitaly allows injection of command-line flags. This sometimes leads to privilege escalation or remote code execution.

Affected products

GitLab: before 11.11.8; from 12.0.0 before 12.0.6; from 12.1.0 before 12.1.6 — fixed in 11.11.8, 12.0.6, 12.1.6

How to fix

Upgrade to a fixed version: GitLab 11.11.8, 12.0.6, 12.1.6. Check the vendor advisory for mitigations.

References

https://about.gitlab.com/blog/categories/releases/
https://about.gitlab.com/releases/2019/08/12/critical-security-release-gitlab-12-dot-1-dot-6-released/
https://gitlab.com/gitlab-org/gitaly/issues/1801
https://gitlab.com/gitlab-org/gitaly/issues/1802
https://about.gitlab.com/blog/categories/releases/
https://about.gitlab.com/releases/2019/08/12/critical-security-release-gitlab-12-dot-1-dot-6-released/
https://gitlab.com/gitlab-org/gitaly/issues/1801
https://gitlab.com/gitlab-org/gitaly/issues/1802

Get alerted when CVE-2019-14944 or the next vulnerability affects your stack