Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

gitlabhq/gitlab-shell

              main @ 5440a75
            

Fixes

CVEs

CRITICAL

Peak severity

Highlights

Auth Bypass: 10 prior fixes. Scrutinize any change in this area.

bin/authorized_keys: most-fixed (2 issues). Treat as high-risk during review.

12 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: The authorized_keys parsing helper is a high-impact target; vulnerabilities occurred due to resolving SSH keys via MD5 fingerprint collisions rather than the full public key, and failing to early-abort on empty key arguments. This allows unauthorized actors to bypass key validation entirely.

Command Injection: Execution commands that passed a single string to the underlying operating system shell instead of an array of shell-escaped arguments enabled arbitrary execution of system utilities, posing a critical remote code execution risk.

Auth Bypass: The use of unanchored regular expressions when matching identity parameters (usernames and keys) allowed partial matches to succeed, enabling attackers to hijack valid administrative or user-scoped authentication flows.