GitLab patched 17 bugs, including a critical flaw with a CVSS score of 9.9  that could let an attacker trigger a pipeline as an arbitrary user, leading to privileged escalation, data exfiltration, and a software supply chain compromise. Security pros consider flaws in a CI/CD pipeline serious because the pipeline just doesn’t automate how developers create, test, and deploy applications, it helps teams find bugs early in the development process, which helps them turn out higher quality software.

Source: SC Magazine