A hidden comment was enough to make GitLab Duo leak private source code and inject untrusted HTML into its responses. [...] a remote prompt injection vulnerability that allows attackers to steal source code from private projects, manipulate code suggestions shown to other users, and even exfiltrate confidential, undisclosed zero-day vulnerabilities -- all through GitLab Duo Chat. [...] We experimented by placing hidden prompts in [...] Every single one of these worked -- GitLab Duo responded to the hidden prompts.
Curated from legitsecurity.com · 22 May 2025 →
GitLab Duo reads a project the way a colleague would: merge request descriptions, commit messages, issue comments, source files. Legit Security put instructions in each of those, hidden from a human reader with Unicode smuggling, Base16 encoding and white KaTeX text, and Duo followed every one. Because Duo renders Markdown as it streams, the injected instruction could make it emit an image tag pointing at an attacker's server with private source code encoded in the URL. Reported on 12 February 2025 and patched by restricting which HTML Duo will render. The lesson generalises past GitLab: a repository is untrusted input the moment anyone outside your team can open a merge request against it.
