GitLab Duo Tricked into Leaking Private Source Code
On this page
Your AI pair-programmer reads the whole repo — including the instructions an attacker hid in it.
| When | May 2025 |
|---|---|
| Target | GitLab Duo (AI assistant) |
| Vendor | GitLab |
| Researcher | Omer Mayraz (Legit Security) |
| Technique | Remote/indirect injection in repo content → markdown/HTML exfil |
| Disclosed | Reported Feb 12; fix merged Apr 2025 (duo-ui!52); public May 20, 2025 |
- 1Attacker hides instructions in a merge request, commit, comment, or source file (invisible Unicode / encoding / white-text KaTeX)
- 2GitLab Duo ingests the project context and obeys them
- 3Duo leaks private code via a rendered image URL and injects malicious links into its answers
What happened
In 2025, Legit Security's Omer Mayraz found that because GitLab Duo analyses the whole project context, hidden instructions in merge-request descriptions, commit messages, issue comments, or source code were obeyed. Payloads were concealed with invisible Unicode, Base16 encoding, and white-text KaTeX. Duo could be made to leak private source code — base64-encoded into an attacker-controlled image URL rendered in its streaming output — and to inject malicious HTML and links into its answers. A demonstrated chain leaked code from a private iOS project. GitLab fixed it before publication (duo-ui!52, merged April 2025).
How the attack worked
Repo content is untrusted, but Duo consumed it as context, and Duo's markdown/HTML output rendered attacker-controlled URLs and tags. That gave the attacker both an instruction path in (hidden text in the repo) and a data path out (rendered images/links).
Root cause
Untrusted developer content sat in the model's context, and model output was rendered as active HTML to arbitrary domains.
What a test would have caught
Planting encoded or invisible instructions in repo artifacts and checking whether Duo exfiltrates data or renders attacker links is the exact test this class needs.
How to prevent it
- Treat all repo content as untrusted input to the assistant.
- Don't render model output as active HTML to arbitrary domains — GitLab's fix blocks non-gitlab.com
img/formtags. - Encode output and strip invisible/encoded payloads before display.
Feel it yourselfThe replay lab plants an instruction in a repo file that a code assistant then follows.
FAQ
How does hidden text in a repo attack the AI?
Duo analyses the whole project context, so instructions concealed in a merge request, commit, comment, or even source code (via invisible Unicode, encoding, or white-text KaTeX) were read and obeyed as commands.
What was the impact?
A demonstrated chain leaked private source code — base64-encoded into an attacker-controlled image URL rendered in Duo's output — and let an attacker inject malicious HTML and links into Duo's responses.
Is it fixed?
GitLab blocked Duo from rendering unsafe tags pointing to non-GitLab domains (duo-ui!52), so the demonstrated exfiltration chain no longer works. A related Duo Chat issue (markdown links leaking private-issue content, reported via HackerOne in 2024) was tracked separately as #454460 and is now closed.
Sources
- Remote Prompt Injection in GitLab Duo Leads to Source Code Theft — Legit Security
- GitLab Duo Vulnerability Enabled Attackers to Hijack AI Responses with Hidden Prompts — The Hacker News
- Prompt injection in combination with markdown links in Duo Chat through malicious issue comments can leak content from private issues (#454460) — GitLab
- fix: add frontend duo link sanitization (duo-ui!52) — GitLab