CVE-2020-13347 Command injection in GitLab Runner

What is CVE-2020-13347?

CVE-2020-13347 is a critical command injection vulnerability in Gitlab Gitlab, published on 7 Oct 2020. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

A command injection vulnerability was discovered in Gitlab runner versions prior to 13.2.4, 13.3.2 and 13.4.1. When the runner is configured on a Windows system with a docker executor, which allows the attacker to run arbitrary commands on Windows host, via DOCKER_AUTH_CONFIG build variable.

Weakness: CWE-22

Which versions are affected by CVE-2020-13347?

1 open source package ship an affected version, including gitlab. It affects 1 product.

Products include Gitlab Gitlab.

How do I fix CVE-2020-13347?

Upgrade gitlab to a fixed version for your release line: 13.2.4, 13.3.2 or 13.4.1.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2020-13347 being exploited?

There is no known exploitation of CVE-2020-13347 in the wild and no public exploit code.

Other vulnerabilities in Gitlab Gitlab

• CVE-2026-97229 GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Exploited Critical 10.0
• CVE-2026-85706 GitLab Community Edition and Enterprise Edition Path Traversal Exploited Critical 10.0
• CVE-2023-7028 GitLab Community and Enterprise Editions Improper Access Control Exploited Critical 10.0
• CVE-2021-22205 GitLab Community and Enterprise Editions Remote Code Execution Exploited Critical 10.0
• CVE-2021-39935 GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF) Exploited Medium 6.8

All Gitlab Gitlab vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BIT-gitlab-2020-13347, GHSA-6x9x-gp76-v665, UBUNTU-CVE-2020-13347.