CVE-2022-2185: GitLab project import command injection enables remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityRemote code execution with low attack complexity and a very high EPSS probability, though it requires an authenticated user with import rights and is not in KEV.

What it is

GitLab versions from 14.0 before 14.10.5, 15.0 before 15.0.4, and 15.1 before 15.1.1 allow an authenticated user with project import permission to import a maliciously crafted project, resulting in OS command injection and remote code execution. The flaw is rated CVSS 3.1 8.8 (HIGH) and affects a core collaboration feature, so any instance exposing project import to non-admin users is at risk.

Impact

An attacker with a valid account and import rights gains remote code execution on the GitLab server, which can lead to full compromise of application data, secrets and the underlying host.

Attack surface

Reached over the network through the project import functionality; the attacker must be authenticated and authorized to import projects, and no user interaction beyond the import action is required per the CVSS vector (AV:N/AC:L/PR:L/UI:N).

Exploitation

Not listed in CISA KEV and no ransomware association is documented, but EPSS is very high at 0.7665 (99.5th percentile), indicating strong likelihood of exploitation; references are vendor advisory, a HackerOne report and a broken issue link, with no public exploit tag.

What to do

• Upgrade GitLab to 14.10.5, 15.0.4, 15.1.1 or later immediately.
• Restrict project import permissions to trusted users and review who currently holds them.
• Disable or limit project import features on internet-facing instances until patched.
• Monitor GitLab release notes and the vendor advisory for any follow-up fixes.
• Audit imported projects for unexpected content or command execution artifacts.

Detection

• Review GitLab logs for project import events from unusual accounts or IPs.
• Hunt for child processes spawned by GitLab components (e.g. git, rails, sidekiq) that indicate command execution.
• Alert on new or modified files in GitLab data, upload and repository directories following imports.
• Correlate import activity with outbound network connections or reverse shell patterns from the GitLab host.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.