gitlab-rails-19.1

Direct Vulnerabilities

Known vulnerabilities in the gitlab-rails-19.1 package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
L Cross-site Scripting (XSS)	<19.1.8-r0
L Missing Authentication for Critical Function	<19.1.8-r0
L Out-of-bounds Write	<19.1.8-r0
L Time-of-check Time-of-use (TOCTOU)	<19.1.8-r0
L Allocation of Resources Without Limits or Throttling	<19.1.8-r0
L Missing Authorization	<19.1.8-r0
L Deserialization of Untrusted Data	<19.1.8-r0
L Missing Authorization	<19.1.8-r0
L Allocation of Resources Without Limits or Throttling	<19.1.8-r0
M Cross-site Scripting (XSS)	<19.1.8-r0
L Missing Authorization	<19.1.8-r0
L Incorrect Authorization	<19.1.8-r0
M Insufficiently Protected Credentials	<19.1.8-r0
L Access Control Check Implemented After Asset is Accessed	<19.1.8-r0
L Incorrect Authorization	<19.1.8-r0
M Resource Injection	<19.1.8-r0
L CVE-2026-85706	<19.1.8-r0
L Authorization Bypass Through User-Controlled Key	<19.1.7-r0
L Allocation of Resources Without Limits or Throttling	<19.1.7-r0
L Authentication Bypass	<19.1.7-r0
H Inclusion of Functionality from Untrusted Control Sphere	<19.1.7-r0
L Loop with Unreachable Exit Condition ('Infinite Loop')	<19.1.7-r0
L Acceptance of Extraneous Untrusted Data With Trusted Data	<19.1.7-r0
L Access Control Check Implemented After Asset is Accessed	<19.1.7-r0
H Directory Traversal	<19.1.4-r0
C Arbitrary Code Injection	<19.1.6-r0
L Cross-site Request Forgery (CSRF)	<19.1.6-r0
L Incorrect Authorization	<19.1.4-r0
L Cross-site Scripting (XSS)	<19.1.4-r0
L Missing Authorization	<19.1.4-r0
H Allocation of Resources Without Limits or Throttling	<19.1.4-r0
L Authorization Bypass Through User-Controlled Key	<19.1.4-r0
L Incorrect Authorization	<19.1.4-r0
L Incorrect Authorization	<19.1.4-r0
L Incorrect Privilege Assignment	<19.1.4-r0
L Missing Authorization	<19.1.4-r0
L Missing Authorization	<19.1.4-r0
L Cross-site Scripting (XSS)	<19.1.4-r0
L Missing Authorization	<19.1.4-r0
L Directory Traversal	*
L CVE-2026-42504	*
L Allocation of Resources Without Limits or Throttling	<19.1.3-r0
L Generation of Incorrect Security Tokens	<19.1.3-r0
L Improperly Controlled Modification of Dynamically-Determined Object Attributes	<19.1.3-r0
L Improper Verification of Cryptographic Signature	*
L CVE-2026-39821	*
H Loop with Unreachable Exit Condition ('Infinite Loop')	*
L Exposure of Sensitive Information Through Metadata	<19.1.3-r0
L Uncontrolled Search Path Element	*
L Resource Exhaustion	*
L Missing Authorization	<19.1.3-r0
H Double Free	*
L Inefficient Regular Expression Complexity	*
M Information Exposure	<19.1.3-r0
H Symlink Following	*
L Incorrect Authorization	<19.1.3-r0
L CVE-2026-27145	*
H Incorrect Behavior Order: Validate Before Canonicalize	*
L Missing Authorization	<19.1.3-r0
L Insufficiently Protected Credentials	<19.1.3-r0
H Loop with Unreachable Exit Condition ('Infinite Loop')	*
L Deserialization of Untrusted Data	*
L Improper Privilege Management	*
L Improper Certificate Validation	*
L Cross-site Scripting (XSS)	<19.1.3-r0
L CVE-2026-42499	*
L Arbitrary Code Injection	<19.1.3-r0
M Time-of-check Time-of-use (TOCTOU)	<19.1.3-r0
H Authentication Bypass	*
L Incorrect Authorization	<19.1.3-r0
L Incorrect Type Conversion or Cast	*
H Allocation of Resources Without Limits or Throttling	*
L Authentication Bypass	*
L Uncontrolled Recursion	*
L Insecure Default Initialization of Resource	*
L Arbitrary Command Injection	<19.1.3-r0
L Arbitrary Command Injection	<19.1.3-r0
L Improper Neutralization	<19.1.3-r0
L Missing Authorization	<19.1.2-r0
L Insufficiently Protected Credentials	<19.1.2-r0
M Use of Incorrectly-Resolved Name or Reference	<19.1.2-r0
L Cross-site Scripting (XSS)	<19.1.2-r0
L Incorrect Authorization	<19.1.2-r0
L Cross-site Scripting (XSS)	<19.1.2-r0
L Missing Authorization	<19.1.2-r0
L Incorrect Authorization	<19.1.2-r0
L Out-of-Bounds	*
L Missing Authorization	*
L CVE-2026-46595	*
L Missing Authorization	*
L Integer Overflow or Wraparound	*
C CVE-2021-23369	*
L Improper Input Validation	*

Vulnerability

Vulnerable Version

Cross-site Scripting (XSS)

<19.1.8-r0