gitpod-io vulnerabilities

Products

• github.com/gitpod-io/gitpod 3
• github.com/gitpod-io/gitpod/components/server/go 1
• github.com/gitpod-io/gitpod/components/ws-proxy 1
• github.com/gitpod-io/gitpod/install/installer 1

Latest gitpod-io CVEs

Newest publication first

1. CVE-2025-55750 Gitpod Classic Affected by Bitbucket OAuth Token Exposure via Redirect Fragment

   Published 2025-08-29

   Medium·CVSS 6.5

   Gitpod is a developer platform for cloud development environments. In versions before main-gha.33628 for both Gitpod Classic and Gitpod Classic Enterprise, OAuth integration with Bitbucket in certain conditions allowed a crafted link to expose a valid Bitbucket access token via t...

2. CVE-2024-21583 github.com/gitpod-io/gitpod vulnerable to Cookie Tossing

   Published 2024-07-19

   Medium·CVSS 4.1

   Versions of the package github.com/gitpod-io/gitpod/components/server/go/pkg/lib before main-gha.27122; versions of the package github.com/gitpod-io/gitpod/components/ws-proxy/pkg/proxy before main-gha.27122; versions of the package github.com/gitpod-io/gitpod/install/installer/p...

3. CVE-2023-32766 Gitpod vulnerable to Cross-site Scripting

   Published 2023-06-05

   Medium·CVSS 6.1

   Gitpod before 2022.11.3 allows XSS because redirection can occur for some protocols outside of the trusted set of three (vscode: vscode-insiders: jetbrains-gateway:).

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.