Loading vulnerability…
Manifest confusion in GitLab CE/EE NPM package registry
CVE-2024-6595 is a low-severity vulnerability in GitLab Community Edition and Enterprise Edition that affects the NPM package registry. In affected versions, it is possible to upload an NPM package with conflicting package data, a condition associated with manifest confusion. This inconsistency in package metadata can cause the registry to accept package content whose identifying data conflicts across package components, undermining expected integrity and consistency checks during package publication and consumption.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows an attacker to publish an NPM package containing conflicting metadata into the GitLab package registry. The primary impact is integrity-related confusion in package handling and package consumers’ trust decisions, which may lead to acceptance or use of inconsistent package information. The available information indicates low severity and does not establish direct code execution or privilege escalation from this issue alone.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure by restricting who can publish packages to the NPM registry, increasing review and validation of published package metadata, and monitoring for anomalous or inconsistent package manifests in internal registries. These measures are only compensating controls; the definitive mitigation is to install a fixed version.
Patch, then assume compromise.
Upgrade GitLab CE/EE to a fixed release: 16.11.6 or later for the 16.11 branch, 17.0.4 or later for the 17.0 branch, or 17.1.2 or later for the 17.1 branch. Self-managed installations running affected versions should apply the vendor-provided security updates promptly.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.