CVE-2024-9773 Improper Neutralization of Special Elements used in a Command ('Command Injection') in GitLab

Low 3.7 Published 27 Mar 2025 Updated 27 Mar 2025

A maintainer can inject malicious code into CLI commands via the Harbor registry integration, potentially leading to code execution.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2024-9773?

CVE-2024-9773 is a low-severity command injection vulnerability in Gitlab Gitlab, published on 27 Mar 2025. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

An issue was discovered in GitLab EE affecting all versions starting from 14.9 before 17.8.6, all versions starting from 17.9 before 17.8.3, all versions starting from 17.10 before 17.10.1. An input validation issue in the Harbor registry integration could have allowed a maintainer to add malicious code to the CLI commands shown in the UI.

Weakness: CWE-77

Which versions are affected by CVE-2024-9773?

1 open source package ship an affected version, including gitlab. It affects 1 product.

Package	Affected	Fixed in
`gitlab` Bitnami	From `14.9.0`	`17.10.1`

Products include Gitlab Gitlab.

How do I fix CVE-2024-9773?

Upgrade gitlab to 17.10.1 or later.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2024-9773 being exploited?

There is no known exploitation of CVE-2024-9773 in the wild and no public exploit code.

All Gitlab Gitlab vulnerabilities

Sources

Also known as BIT-gitlab-2024-9773, GHSA-23jj-xc4c-c6gr, UBUNTU-CVE-2024-9773.