GHSA-5648-rgj9-v224: @zereight/mcp-gitlab has multiple safety-control bypasses: execute_graphql read-only + allow-list bypass, unauthenticated transports, session-exhaustion DoS
@zereight/mcp-gitlab exposes GitLab to an LLM agent while relying on read-only mode, a project allow-list, and transport auth as its safety controls. Five defects defeat those controls. Under the MCP threat model, tool-call arguments/content can be shaped by untrusted input (prompt injection) or a malicious client.
Reviewed commit: 60adcc0de5b0e96c4c2029f7a25d2775946421d8 (package version 2.1.28). Source review only; PoCs are local/offline.
- F1 (HIGH) execute_graphql defeats BOTH read-only mode and GITLAB_ALLOWED_PROJECT_IDS.
- F2 (HIGH, deployment-conditional) Streamable HTTP /mcp unauthenticated under cookie-jar / device-flow credentials.
- F3 (MEDIUM) SSE unauthenticated by default, no Origin/Host validation (DNS rebinding).
- F4 (HIGH) unauthenticated session/transport-exhaustion DoS (token check is syntactic only).
- F5 (LOW) CI job trace returned verbatim (prompt-injection surface).
References
- github.com/advisories/GHSA-5648-rgj9-v224
- github.com/zereight/gitlab-mcp/commit/69e784da33e96e64867b511c6f14d3f21f91ba8b
- github.com/zereight/gitlab-mcp/issues/596
- github.com/zereight/gitlab-mcp/issues/748
- github.com/zereight/gitlab-mcp/pull/571
- github.com/zereight/gitlab-mcp/pull/624
- github.com/zereight/gitlab-mcp/releases/tag/v2.1.30
- github.com/zereight/gitlab-mcp/security/advisories/GHSA-5648-rgj9-v224
Code Behaviors & Features
Detect and mitigate GHSA-5648-rgj9-v224 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →