Remote Prompt Injection in GitLab Duo Leads to Source Code Theft (www.legitsecurity.com)
from tedu@inks.tedunangst.com to inks@inks.tedunangst.com on 24 May 23:48
https://inks.tedunangst.com/l/5236

A hidden comment was enough to make GitLab Duo leak private source code and inject untrusted HTML into its responses. GitLab patched the issue, and we’ll walk you through the full attack chain — which demonstrates five vulnerabilities from the 2025 OWASP Top 10 for LLMs.

#ai #development #exploit #security #turtles #web

#ai #development #exploit #inks #security #turtles #web