CVE-2022-2251

CVE-2022-2251 is an improper sanitization vulnerability in GitLab Runner, affecting all versions prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2. A malicious user can craft a special branch name, and if another user triggers a pipeline on that branch, commands can be executed in the runner as the second user. This vulnerability has a CVSS score of 8.0 (High), indicating a network-based attack with low complexity, requiring user interaction, and leading to high impact on confidentiality, integrity, and availability. Currently, there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or KEV listing, though it has received some community discussion and media coverage.