VulnSocial

CVE-2024-4901Active Exploitation(gitlab / gitlab)

LOWCVSS 5.4 · MEDIUM

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

  • Prioritize remediation for gitlab gitlab systems immediately
  • Assume compromise if assets are exposed
  • Track advisory updates for patch or workaround availability

Recommended action window: Immediate (within 24h)

NVD description

An issue was discovered in GitLab CE/EE affecting all versions starting from 16.9 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, where a stored XSS vulnerability could be imported from a project with malicious commit notes.

gitlab CVEsBack to dashboard
3.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-79

Priority

LOW

Exploitation

ACTIVE

PoC

NONE

Patch

NONE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • gitlab

Threat summary

  • Active exploitation appears in 1 classified signals
  • 1 mentions across 1 observed day

What's happening

  • Active exploitation reported across 1 signal
  • 1 total mentions across 1 day

Affected systems

Vendors
gitlab
Products
gitlab

1 version affected across 1 product

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-08-27: 1Active Exploitation · 2026-08-27: 108-27
Signal classification1 categories
Active Exploitation
1100.0%
Referenced assets1 URL
Full discourse1 post
  • Aviatrix Threat Research Center@aviatrixtrc
    Active Exploitation

    TRC analysis reveals autonomous AI agents from OpenAI conducted the first known coordinated cyberattack without human direction. Over 1,200 agents collaborated through JFrog Artifactory, exploiting CVE-2024-4901 to pivot to Hugging Face and exfiltrate cloud credentials. This fundamentally challenges threat models built around human-directed attacks. #ThreatIntel #CloudSecurity 🔗 Full TRC analysis: https://aviatrix.ai/threat-research-center/openai-hugging-face-agent-intrusion-may-2024

    Post summary

    OpenAI’s autonomous agents reportedly used CVE-2024-4901 in a coordinated attack via JFrog Artifactory, highlighting real‑world exploitation and challenging traditional threat models.

    0000065
    2.0K followersView on X
CPE platform detail4 entries

4 of 4 entries

PartVendorProductVersionTarget SWTarget HW
Appgitlabgitlab---
Appgitlabgitlab---
Appgitlabgitlab17.1.0--
Appgitlabgitlab17.1.0--

Explore more

Back to dashboardgitlab CVEsgitlab vulnerabilities