A remote prompt injection flaw in GitLab Duo, the platform’s AI coding assistant, allowed attackers to leak private code and inject malicious HTML into user-facing content. The issue was responsibly disclosed in February 2025 and has since been patched.
Hidden Prompts Exploited Duo’s Context Awareness
Attackers used encoded prompts hidden in merge requests, commits, or comments to manipulate Duo’s behavior. Techniques included Unicode smuggling and Base16 payloads to bypass detection, aligning with several 2025 OWASP LLM Top 10 vulnerabilities, including Prompt Injection and Information Disclosure.
HTML Injection via Markdown Streaming
The most severe risk came from how Duo streamed markdown into HTML. Despite using DOMPurify, tags like <img> and <a> weren’t fully sanitized. This allowed attackers to embed Base64-encoded data in image tags, which browsers then sent to attacker-controlled servers—leaking sensitive code.
Patch and Lessons Learned
GitLab released patch duo-ui!52 to block unsafe HTML rendering from external domains. Researcher Omer Mayraz emphasized that AI tools must now be considered part of the security perimeter and treated with the same scrutiny as any web-exposed input processor.
Stay alert: AI coding assistants increase productivity—but also expand the attack surface. Ensure your tools are patched and input is strictly validated.
