Loading vulnerability…
CVE-2023-3401 is a medium-severity vulnerability in GitLab Community Edition and Enterprise Edition in which a repository whose main branch uses a specially designed name can cause GitLab to create repositories containing malicious code. The issue affects all versions before 16.0.8, versions from 16.1 before 16.1.3, and versions from 16.2 before 16.2.2. Available information indicates the flaw is tied to insufficient handling or validation of specially crafted repository naming conditions associated with the main branch, enabling repository creation behavior that can introduce attacker-controlled malicious code.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A previously identified GitLab vulnerability referenced only as the flaw whose protections were bypassed by CVE-2023-5226.
A medium-severity GitLab vulnerability where a specially designed repository name on the main branch may allow creation of repositories with malicious code.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.