Critical GitLab Bug Lets Attackers Poison Your Code (Patch Now)

A critical GitLab vulnerability could allow an unauthenticated attacker to modify or delete public project and user data—and potentially threaten the integrity of your software supply chain. In this episode of IT SPARC Cast – CVE of the Week, John and Lou break down CVE-2026-19478, a CVSS 9.4 code-injection vulnerability affecting multiple GitLab releases.

Patching is only the beginning. If an attacker made changes before the fix was installed, malicious code could already be hiding in a repository, CI/CD pipeline, build, or downstream release. John and Lou explain how to audit GitLab…