vulnerabilities

Gets or lists a vulnerabilities resource.

Overview

Name	vulnerabilities
Type	Resource
Id	gitlab.security.vulnerabilities

Fields

The following fields are returned by SELECT queries:

list

GraphQL response envelope

Name	Datatype	Description
id	string	GraphQL ID of the vulnerability.
name	string	Name or title of the object.
ai_resolution_available	boolean	Indicates whether the type of vulnerability can be resolved with AI.
ai_resolution_enabled	boolean	Indicates whether the specific vulnerability can be resolved with AI.
confirmed_at	string	Timestamp of when the vulnerability state was changed to confirmed.
description	string	Description of the vulnerability.
detected_at	string	Timestamp of when the vulnerability was first detected.
dismissal_reason	string	Reason for dismissal. Returns null for states other than dismissed. (ACCEPTABLE_RISK, FALSE_POSITIVE, MITIGATING_CONTROL, USED_IN_TESTS, NOT_APPLICABLE)
dismissed_at	string	Timestamp of when the vulnerability state was changed to dismissed.
false_positive	boolean	Indicates whether the vulnerability is a false positive.
has_remediations	boolean	Indicates whether there is a remediation available for the vulnerability.
present_on_default_branch	boolean	Indicates whether the vulnerability is present on the default branch or not.
project	object	Project identity (id, full_path, name)
removed_from_code	boolean	Indicates whether the vulnerability is present in the code or not.
report_type	string	Type of the security report that found the vulnerability (SAST, DEPENDENCY_SCANNING, CONTAINER_SCANNING, DAST, SECRET_DETECTION, COVERAGE_FUZZING, API_FUZZING, CLUSTER_IMAGE_SCANNING, CONTAINER_SCANNING_FOR_REGISTRY, SARIF, GENERIC). Scan Type in the UI. (SAST, DEPENDENCY_SCANNING, CONTAINER_SCANNING, DAST, SECRET_DETECTION, COVERAGE_FUZZING, API_FUZZING, CLUSTER_IMAGE_SCANNING, CONTAINER_SCANNING_FOR_REGISTRY, SARIF, GENERIC)
resolved_at	string	Timestamp of when the vulnerability state was changed to resolved.
resolved_on_default_branch	boolean	Indicates whether the vulnerability is fixed on the default branch or not.
severity	string	Severity of the vulnerability (INFO, UNKNOWN, LOW, MEDIUM, HIGH, CRITICAL) (INFO, UNKNOWN, LOW, MEDIUM, HIGH, CRITICAL)
solution	string	Recommended solution for the vulnerability.
state	string	State of the vulnerability (DETECTED, CONFIRMED, RESOLVED, DISMISSED) (CONFIRMED, DETECTED, DISMISSED, RESOLVED)
state_comment	string	Comment given for the vulnerability state change.
title	string	Title of the vulnerability.
unverified	boolean	Indicates whether the finding was detected without an identified source (untrusted input).
updated_at	string	Timestamp of when the vulnerability was last updated.
user_notes_count	integer	Number of user notes attached to the vulnerability.
uuid	string	UUID of the vulnerability finding. Can be used to look up the associated security report finding.
vulnerability_path	string	Path to the vulnerability's details page.
web_url	string	URL to the vulnerability's details page.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
list	select	host	has_ai_resolution, has_issues, has_merge_request, has_remediations, has_resolution, identifier_name, sort	Vulnerabilities reported on projects on the current user's instance security dashboard. Generated from the GitLab GraphQL schema field Query.vulnerabilities (connection of Vulnerability nodes).

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
host	string	GitLab host, with an optional port (default gitlab.com). Resolved from the GITLAB_HOST environment variable when it is set (x-stackQL-envVar); a WHERE host value always takes precedence. Self-managed instances: the provider is generated from the gitlab.com schema, so older instances may reject fields they do not serve. (default: gitlab.com, x-stackQL-envVar: GITLAB_HOST)
has_ai_resolution	boolean	Returns only the vulnerabilities which can likely be resolved by GitLab Duo Vulnerability Resolution.
has_issues	boolean	Returns only the vulnerabilities which have linked issues.
has_merge_request	boolean	Returns only the vulnerabilities which have linked merge requests.
has_remediations	boolean	Returns only the vulnerabilities which have remediations.
has_resolution	boolean	Returns only the vulnerabilities which have been resolved on default branch.
identifier_name	string	Filter vulnerabilities by identifier name. Ignored when applied on instance security dashboard queries.
sort	string	List vulnerabilities by sort order.

SELECT examples

list

Vulnerabilities reported on projects on the current user's instance security dashboard. Generated from the GitLab GraphQL schema field Query.vulnerabilities (connection of Vulnerability nodes).

SELECT
id,
name,
ai_resolution_available,
ai_resolution_enabled,
confirmed_at,
description,
detected_at,
dismissal_reason,
dismissed_at,
false_positive,
has_remediations,
present_on_default_branch,
project,
removed_from_code,
report_type,
resolved_at,
resolved_on_default_branch,
severity,
solution,
state,
state_comment,
title,
unverified,
updated_at,
user_notes_count,
uuid,
vulnerability_path,
web_url
FROM gitlab.security.vulnerabilities
WHERE host = '{{ host }}' -- required (defaults to gitlab.com; or set GITLAB_HOST)
AND has_ai_resolution = '{{ has_ai_resolution }}'
AND has_issues = '{{ has_issues }}'
AND has_merge_request = '{{ has_merge_request }}'
AND has_remediations = '{{ has_remediations }}'
AND has_resolution = '{{ has_resolution }}'
AND identifier_name = '{{ identifier_name }}'
AND sort = '{{ sort }}'
;