Case gitlab-duo-hidden-promptPrompt injectionUnited States
GitLab Duo prompt injection leaks private source code via hidden merge request text
Legit Security showed prompts hidden with Unicode smuggling, Base16 or white KaTeX text in merge requests and issues could make GitLab Duo exfiltrate private code and inject HTML into its responses. GitLab patched it.
MediumAttack on AIStatus: PatchedVerified case file
Open in the interactive mapCite this case
- Reported
- May 22, 2025
- Location
- United States
- Target
- GitLab Duo AI assistant
- Severity
- Medium
- Triggered by
- Legit Security research team
- Actor type
- Security researchers
- Reported loss
- None reported
- CVE
- None
What happened
Legit Security showed prompts hidden with Unicode smuggling, Base16 or white KaTeX text in merge requests and issues could make GitLab Duo exfiltrate private code and inject HTML into its responses. GitLab patched it.
Impact: Potential leak of private source code and malicious package suggestions to developers; no exploitation reported
Who triggered it
Actor: Legit Security research team
Attribution: Reported to GitLab on 12 February 2025 and fixed before disclosure
Motive: Security research
How it happened
Attack vector: Indirect prompt injection in project content Duo reads; streamed markdown rendered as HTML enabled script and image-based exfiltration
Root cause: Duo ingested full page context including comments and descriptions as instructions, and rendered output as HTML before sanitisation
Timeline
- Legit Security reports the issues to GitLab
- GitLab ships fixes
- Public disclosure
Response
GitLab addressed the rendering and injection issues
Current status: Patched
Sources (open in a new tab)
- Legit Security legitsecurity.com
- The Hacker News thehackernews.com
- TechRepublic techrepublic.com
Cite this case
GitLab Duo prompt injection leaks private source code via hidden merge request text. AI Threat Watch, case gitlab-duo-hidden-prompt, May 22, 2025. https://aithreat.io/cases/gitlab-duo-hidden-prompt/
Permanent link: https://aithreat.io/cases/gitlab-duo-hidden-prompt/