logoalt Hacker News

dvdkon • today at 9:30 PM • 1 reply • view on HN

As far as I can tell, it requires forcing GitLab to render a malicious org-mode file. I don't really see a way to do that without authenticating and uploading one. Am I missing something?

Replies

merb • today at 10:07 PM

    The attack needs no authentication — only one public project that can hold the .org payload.
So probably not vulnerable if no public projects exist - ie self hosted has an needs auth for everything mode.