Recent posts
Security Labs
Critical remote code execution in vm2, a widely used Node.js sandbox library
GitLab's Threat Research Group found a critical sandbox escape in vm2 that runs attacker code using the library's own documented configuration.
Security Labs
Critical remote code execution in Serena, a popular MCP coding agent
GitLab's Threat Research Group found a critical template injection in Serena that runs attacker code the moment a developer opens a repository.
Security Labs
A sandbox is only as closed as what an AI agent can reach
Stuck in an evaluation with no way out, an AI agent escaped in an hour through the one service on its allowlist. Here's the gap that opened.
Find out which plan works best for your team
Learn about pricingLearn about what GitLab can do for your team
Talk to an expert