Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
gitlabhq/gitlab-runner
main @ 168e017
156
Fixes
0
CVEs
CRITICAL
Peak severity
Highlights
Denial of Service: 56 prior fixes. Scrutinize any change in this area.
shells/abstract.go: most-fixed (11 issues). Treat as high-risk during review.
40 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Remote Code Execution: Malicious or compromised controllers can achieve arbitrary remote code execution on the runner by injecting pre- and post-get-sources script hooks directly into the job payload. Reverting payload-driven script execution prevents unauthorized command invocation.
Auth Bypass: The runner historically allowed users to bypass namespace, ServiceAccount, and user-ID isolation boundaries. Untrusted builds could run as root via leading zeros in UID/GID strings or alter shared runner configuration fields in memory to hijack subsequent jobs.
Path Traversal: Cache management, zip archiving, and directory traversal checks are heavily prone to protection bypasses using trailing spaces, slashes, backslashes, or URL-encoded sequences that escape the intended base directory.