Fetching from the wire…
01
02
03
04
05
06
07
08
Security2026-08-27 · source-backed
Patched in EE 19.3.1, 19.2.5 and 19.1.7, covering everything from 18.9, CVSS 7.3. An authenticated user with only Developer permissions could get the agent to process configuration they control and execute arbitrary commands inside the CI context (NVD). The blast radius is whatever the runner holds: source, package registries, deploy credentials, cloud tokens. This is the config-file-as-injection-surface problem that CLAUDE.md-style files create, hit in a hosted CI product rather than on a laptop.
Each link below shares sources, entities, or timing with this story.
GitLab partners with Anthropic / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (GitLab partners with Anthropic); both cover CLAUDE, CVE, CVSS, NVD; overlapping topics (agent, claude, command).
Claude Code supports GitLab / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (Claude Code supports GitLab); both cover Claude, CVSS; overlapping topics (agent, claude, cloud, context).
GitLab partners with Anthropic / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (GitLab partners with Anthropic); both cover Claude, CVE; overlapping topics (agent, claude, control).
Copilot uses Claude / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (Copilot uses Claude); both cover CLAUDE, CVE; overlapping topics (agent, claude, user).
Linked by a graph relationship (Copilot uses Claude); both cover CLAUDE, CVE; overlapping topics (agent, claude, context).
Claude Code supports GitLab / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (Claude Code supports GitLab); both cover CLAUDE, CVE; overlapping topics (agent, claude, command).
GitLab partners with Anthropic / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (GitLab partners with Anthropic); both cover CVE, CVSS; overlapping topics (agent, claude, context).
Claude Code supports GitLab / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (Claude Code supports GitLab); both cover CLAUDE, CVSS; overlapping topics (agent, claude, context).