Disclosed vulnerability
GitLab Duo: hidden prompts in merge requests leaked private source code via HTML injection
AIR-2025-0035 AIR record · 2025-05-gitlab-duo-prompt-injection
From the supporting source
A remote prompt injection vulnerability that allows attackers to steal source code from private projects, manipulate code suggestions shown to other userslegitsecurity.com
The record
Disclosed
2025-05-22
Vendor
GitLab
Product
GitLab Duo Chat
Risk domain
Privacy › Data exfiltration channels
Also touches
Confused deputy
System type
Generative model
Who acted
Agent acted — Duo retrieved private source and rendered HTML that leaked it
Attack surface
Coding agent
Autonomy level
Assistant
Initial vector
Indirect prompt injection merge request
Impact type
Data exfiltration, Private source code disclosure, Malicious code suggestion, Code suggestion manipulation, Vulnerability disclosure leak
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI02 – Tool Misuse and Exploitation
- MITRE ATLAS
- AML.T0024 – Exfiltration via AI Inference API
- NIST AI RMF
- MAP 4.2
- EU AI Act
- Article 10
- ISO/IEC
- TR 24028; 23894
- AIUC-1
- A. Data & Privacy
- Scope
- tool misuse
- Mitigation
- Monitor network traffic for anomalous patterns; Restrict egress destinations.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
GitLab Duo users on GitLab.com and self-managed instances prior to the fix
Capability abused
Defense & remediation
Recorded defense
output sanitization, defeated by streaming markdown rendering that emitted raw HTML before sanitization completed
Guardrail kinds
Unknown
Guardrail outcome
Silent
Fix shipped
GitLab patched via duo-ui!52 - unsafe external-domain HTML tags such as <img> and <form> are no longer rendered (disclosed 2025-02-12)
Taxonomy & references
Curator notes
Omer Mayraz, Legit Security. Injections could be hidden in merge-request descriptions, commit messages, issue comments or source code; private diffs were base64-encoded into an <img> src pointing at an attacker server. Researchers also demonstrated leaking confidential, undisclosed zero-day vulnerability reports and poisoning code suggestions shown to other users. Also reported as: 'Remote prompt injection in GitLab Duo leaks private source code via injected HTML'.
Supporting sources
Cite as
Enkrypt AI. "GitLab Duo: hidden prompts in merge requests leaked private source code via HTML injection". AIR, AIR-2025-0035. https://agentincident.vercel.app/i/AIR-2025-0035/ (accessed 2026-10-19).