CVE-2025-8279 is a high severity (CVSS 8.7) flaw in the GitLab Language Server. Versions 7.6.0 and later, before 7.30.0, do not validate input well enough, which allows arbitrary GraphQL query execution. Upgrade to 7.30.0 or later, including any editor extension that bundles the server.
What's affected
GitLab Language Server from 7.6.0 up to, but not including, 7.30.0. The fixed version is 7.30.0, per the record's description. The Language Server is the component editor integrations use to talk to GitLab, so you may have it without installing it by name. For example, editor extensions such as GitLab Workflow can bundle it.
The record scores the issue 8.7 with the vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N. It describes the cause as insufficient input validation, but lists the weakness as CWE-306 (Missing Authentication for Critical Function). That is a mismatch in wording rather than a conflict in versions, and it suggests the Language Server accepted GraphQL requests it should have restricted.
I could not read the GitLab issue linked from the record. The page returned a not found error, which usually means it is private or restricted. The affected and fixed versions here therefore come from the NVD record alone. Check GitLab's release and security notes for the exact fixed builds of any editor extension you use.
How to check if you're exposed
Find which editor extensions your developers run that bundle the GitLab Language Server, and what version of the server each uses. Look at the extension's changelog or its release notes for the bundled server version.
If you install the server as a package, list it:
npm ls @gitlab-org/gitlab-lsp
The package name is the one commonly used for this tool, so confirm it against your own tooling. Any version from 7.6.0 up to 7.29.x is in scope.
Developer machines are the target here, not a server. Include laptops and cloud development environments in your search.
What to do now
- Inventory editor extensions and tools that bundle the GitLab Language Server.
- Update them to a release that carries Language Server 7.30.0 or later.
- Turn on automatic extension updates for developer editors if your policy allows it.
- Check GitLab's security notes for anything further on this CVE.
- Treat GitLab personal access tokens used in editors as sensitive and rotate them if you suspect misuse.
Why it matters
The record rates the flaw high because of the vector: network reachable, no privileges, and a changed scope with high impact on confidentiality and integrity. A GraphQL API is a flexible way to read and change data, so a component that can be made to run arbitrary queries may reach more than it should. Whether data is actually reachable depends on the permissions of the token in use.
This is a good example of tooling risk that does not show up in production scans. The record does not flag this CVE as CISA KEV and makes no claim of exploitation in the wild.
Try it yourself
This demo shows how a dependency inventory answers the first question of any advisory: do we run this component at all.
Click through it at your own pace, or open it full screen.
Quick check
Which version fixes CVE-2025-8279?
The record says versions before 7.30.0 are affected, so 7.30.0 or later is the fixed line. Confirm with GitLab for the extension you use.
Do I have to install the Language Server myself?
Not always. Editor extensions can bundle it, so you may be running it without having installed it directly.
Sources
- CVE-2025-8279 on Safeguard Gold
- NVD record for CVE-2025-8279, published 2025-07-28. The GitLab issue linked from the record returned not found when fetched.
Last reviewed: 18 October 2026.
