- Explaining a vulnerability
- Vulnerability Resolution
- Vulnerability code flow
- Vulnerability status values
- Vulnerability dismissal reasons
- Change the status of a vulnerability
- Create a GitLab issue for a vulnerability
- Linking a vulnerability to GitLab and Jira issues
- Resolve a vulnerability
- Enable security training for vulnerabilities
- View security training for a vulnerability
Vulnerability Page
Each vulnerability in a project has a vulnerability page containing details of the vulnerability, including:
- Description
- When it was detected
- Current status
- Available actions
- Linked issues
- Actions log
- Filename and line number of the vulnerability (if available)
If the scanner determined the vulnerability to be a false positive, an alert message is included at the top of the vulnerability’s page.
When a vulnerability is no longer detected in a project’s default branch, you should change its status to Resolved. This ensures that if it is accidentally reintroduced in a future merge, it is reported again as a new record. To change the status of multiple vulnerabilities, use the Vulnerability Report’s Activity filter.
Explaining a vulnerability
- experiment on GitLab.com.
- Promoted to beta status in GitLab 16.2.
- in GitLab 17.2.
GitLab can help you with a vulnerability by using a large language model to:
- Summarize the vulnerability.
- Help developers and security analysts to understand the vulnerability, how it could be exploited, and how to fix it.
- Provide a suggested mitigation.
Vulnerability Explanation
Explain a vulnerability with GitLab Duo Vulnerability Explanation. Use the explanation to better understand a vulnerability and its possible mitigation.
Prerequisites:
- You must have the GitLab Ultimate subscription tier.
- Have a paid GitLab Duo Enterprise seat.
- GitLab Duo must be enabled for the group or instance.
- You must be a member of the project.
- The vulnerability must be from a SAST scanner.
To explain the vulnerability:
- On the left sidebar, select Search or go to and find your project.
- Select Secure > Vulnerability report.
- Optional. To remove the default filters, select Clear ().
- Above the list of vulnerabilities, select the filter bar.
- In the dropdown list that appears, select Tool, then select all the values in the SAST category.
- Select outside the filter field. The vulnerability severity totals and list of matching vulnerabilities are updated.
- Select the SAST vulnerability you want explained.
-
Do one of the following:
- Select the text below the vulnerability description that reads You can also use AI by asking GitLab Duo Chat to explain this vulnerability and a suggested fix.
- In the upper right, from the Resolve with merge request dropdown list, select Explain vulnerability, then select Explain vulnerability.
- Open GitLab Duo Chat and use the explain a vulnerability command by typing
/vulnerability_explain
.
The response is shown on the right side of the page.
On GitLab.com this feature is available. By default, it is powered by Anthropic’s claude-3-haiku
model. We cannot guarantee that the large language model produces results that are correct. Use the
explanation with caution.
Data shared with third-party AI APIs for Vulnerability Explanation
The following data is shared with third-party AI APIs:
- Vulnerability title (which might contain the filename, depending on which scanner is used).
- Vulnerability identifiers.
- Filename.
Vulnerability Resolution
- experiment on GitLab.com.
- Changed to beta in GitLab 17.3.
Use GitLab Duo Vulnerability resolution to automatically create a merge request that
resolves the vulnerability. By default, it is powered by Anthropic’s claude-3.5-sonnet
model.
We can’t guarantee that the large language model produces correct results. You should always review the proposed change before merging it. When reviewing, check that:
- Your application’s existing functionality is preserved.
- The vulnerability is resolved in accordance with your organization’s standards.
Prerequisites:
- You must have the GitLab Ultimate subscription tier and GitLab Duo Enterprise.
- You must be a member of the project.
- The vulnerability must be a SAST finding from a supported analyzer:
- Any GitLab-supported analyzer.
- A properly integrated third-party SAST scanner that reports the vulnerability location and a CWE Identifier for each vulnerability.
- The vulnerability must be of a supported type.
Learn more about how to enable all GitLab Duo features.
To resolve the vulnerability:
- On the left sidebar, select Search or go to and find your project.
- Select Secure > Vulnerability report.
- Optional. To remove the default filters, select Clear ().
- Above the list of vulnerabilities, select the filter bar.
- In the dropdown list that appears, select Tool, then select all the values in the SAST category.
- Select outside the filter field. The vulnerability severity totals and list of matching vulnerabilities are updated.
- Select the SAST vulnerability you want resolved.
- A blue icon is shown next to vulnerabilities that support Vulnerability Resolution.
- In the upper-right corner, select Resolve with AI.
- Add an additional commit to the MR. This forces a new pipeline to run.
- After the pipeline is complete, on the pipeline security tab, confirm that the vulnerability no longer appears.
- On the vulnerability report, manually update the vulnerability.
A merge request containing the AI remediation suggestions is opened. Review the suggested changes, then process the merge request according to your standard workflow.
Provide feedback on this feature in .
To ensure that suggested resolutions are high-quality, Vulnerability Resolution is available for a specific set of vulnerabilities.
The system decides whether to offer Vulnerability Resolution based on the vulnerability’s Common Weakness Enumeration (CWE) identifier.
We selected the current set of vulnerabilities based on testing by automated systems and security experts.
We are actively working to expand coverage to more types of vulnerabilities.
Vulnerability Resolution sometimes cannot generate a suggested fix. Common causes include:
The following data is shared with third-party AI APIs:
For some vulnerabilities detected by Advanced SAST, a Code flow tab is available. A
vulnerability’s code flow is the path the data takes from the user input (source) to the vulnerable
line of code (sink), through all assignments, manipulation, and sanitization. This information helps
you understand and evaluate the vulnerability’s context, impact, and risk.
The Code flow tab shows:
A vulnerability’s status can be:
When you dismiss a vulnerability you must choose one of the following reasons:
Prerequisites:
To change a vulnerability’s status from its Vulnerability Page:
From the Status dropdown list select a status, then select Change status.
In GitLab 15.11 and later, you must select a dismissal reason when you change a vulnerability’s status to Dismissed.
Details of the status change, including who made the change and when, are recorded in the
vulnerability’s action log.
You can create a GitLab issue to track any action taken to resolve or mitigate a vulnerability.
To create a GitLab issue for a vulnerability:
The issue is created in the GitLab project with information from the vulnerability report.
To create a Jira issue, see Create a Jira issue for a vulnerability.
You can link a vulnerability to one or more existing GitLab
or Jira issues. Only one linking feature is available at the same time.
Adding a link helps track the issue that resolves or mitigates a vulnerability.
Prerequisites:
To link a vulnerability to existing GitLab issues:
The selected GitLab issues are added to the Linked items section, and the linked issues counter is
updated.
GitLab issues linked to a vulnerability are shown in the Vulnerability Report and the vulnerability’s page.
Be aware of the following conditions between a vulnerability and a linked GitLab issue:
Prerequisites:
To link a vulnerability to existing Jira issues, add the following line to the Jira issue’s description:
Jira issues with appropriate description are added to the Related Jira issues section, and the linked issues counter is
updated.
Jira issues linked to a vulnerability are shown only on the vulnerability page.
Be aware of the following conditions between a vulnerability and a linked Jira issue:
For some vulnerabilities a solution is already known but needs to be implemented manually. The
Solution field in the Vulnerability page is provided by the security scanning tool that
reported the security finding, or entered during the manual creation of a vulnerability.
The GitLab tools utilize information from the GitLab Advisory Database.
Additionally, some tools may include a software patch to apply the suggested solution. In those instances,
a vulnerability’s page includes a Resolve with merge request option.
The following scanners are supported by this feature:
To resolve a vulnerability, you can either:
To resolve the vulnerability with a merge request:
A merge request is created which applies the patch required to resolve the vulnerability.
Process the merge request according to your standard workflow.
To manually apply the patch that GitLab generated for a vulnerability:
Security training helps your developers learn how to fix vulnerabilities. Developers can view security training from selected educational providers, relevant to the detected vulnerability.
To enable security training for vulnerabilities in your project:
Each integration submits the Vulnerability identifier, for example CWE or OWASP, and the language to the security training vendor. The resulting link to the vendor training is what appears in a GitLab Vulnerability.
The vulnerability page may include a training link relevant to the detected vulnerability if security training is enabled.
The availability of training depends on whether the enabled training vendor has content matching the particular vulnerability.
Training content is requested based on the vulnerability identifiers.
The identifier given to a vulnerability varies from one vulnerability to the next and the available training
content varies between vendors. Some vulnerabilities do not display training content.
Vulnerabilities with a CWE are most likely to return a training result.
To view the security training for a vulnerability:
Supported vulnerabilities for Vulnerability Resolution
View the complete list of supported CWEs for Vulnerability Resolution
Troubleshooting
Data shared with third-party AI APIs for Vulnerability Resolution
Vulnerability code flow
Vulnerability status values
Vulnerability dismissal reasons
Change the status of a vulnerability
Developers
to change the status of a vulnerability (admin_vulnerability
) was deprecated. The admin_vulnerability
permission will be removed, by default, from all Developer
roles in GitLab 17.0.
admin_vulnerability
permission.
Create a GitLab issue for a vulnerability
Linking a vulnerability to GitLab and Jira issues
Link a vulnerability to existing GitLab issues
#
).
Link a vulnerability to existing Jira issues
/-/security/vulnerabilities/<id>
<id>
is any vulnerability ID.
You can add several lines with different IDs to one description.
Resolve a vulnerability
yarn
. Also, Automatic patch creation is only supported when FIPS mode is disabled.
Resolve a vulnerability with a merge request
Resolve a vulnerability manually
git apply remediation.patch
.
Enable security training for vulnerabilities
View security training for a vulnerability