[{"data":1,"prerenderedAt":1287},["ShallowReactive",2],{"/ja-jp/blog/deepseek-reasonix-vulnerability-discovered":3,"navigation-ja-jp":527,"banner-ja-jp":960,"footer-ja-jp":968,"blog-post-authors-ja-jp-Abisheik Magesh|Daniel Abeles":1222,"blog-related-posts-ja-jp-deepseek-reasonix-vulnerability-discovered":1248,"blog-share-wrapper-ja-jp":1268,"next-steps-ja-jp":1278},{"id":4,"title":5,"authors":6,"body":9,"category":507,"date":508,"description":509,"extension":510,"externalUrl":511,"faq":511,"featured":512,"heroImage":513,"meta":514,"navigation":512,"path":515,"seo":516,"slug":519,"stem":520,"tags":521,"template":524,"updatedDate":525,"__hash__":526},"blogPosts/ja-jp/blog/deepseek-reasonix-vulnerability-discovered.md","AIコーディングエージェントDeepSeek-Reasonixに設定ファイル汚染によるコマンド実行の脆弱性",[7,8],"Abisheik Magesh","Daniel Abeles",{"type":10,"value":11,"toc":489},"minimark",[12,34,45,52,92,96,114,121,124,149,156,166,169,173,176,227,234,237,253,259,262,265,294,298,302,308,312,315,381,384,387,390,446,449,453,462,468,471,474,480],[13,14,15,16,22,23,28,29,33],"p",{},"GitLabの脅威リサーチグループは、AIコーディングアシスタントとのペア作業を想定したデスクトップGitクライアント「DeepSeek-Reasonix Studio」に、コマンド実行の脆弱性（",[17,18,21],"a",{"href":19,"rel":20},"https://github.com/esengine/DeepSeek-Reasonix/security/advisories/GHSA-grg2-7gc6-36m6",[],"GHSA-grg2-7gc6-36m6","、",[17,24,27],{"href":25,"rel":26},"https://gitlab.com/gitlab-org/cves/-/blob/master/2026/CVE-2026-102437.json",[],"CVE-2026-102437","）を発見しました。ConfigPoisoningと名付けたこの脆弱性では、デベロッパーがファイルの差分を表示した時点で、攻撃者が用意したコードが実行されるおそれがあります。対処するには、DeepSeek-Reasonix Studio 2.21.0、または",[30,31,32],"code",{},"DeepSeek Reasonix"," npm 1.39.3へアップデートしてください。",[13,35,36,37,40,41,44],{},"これはDeepSeek-Reasonix固有の問題ではありません。GitLabの脅威リサーチグループの調査では、広く使われている複数のコーディングエージェントが同じ種類の脆弱性を抱えていました。いずれも、リポジトリ自身の",[30,38,39],{},".git/config","や",[30,42,43],{},".gitattributes","から、攻撃者が指定したコマンドが動いてしまうというものです。全容を公開するのは、このDeepSeek-Reasonixが最初の事例になります。",[13,46,47,51],{},[48,49,50],"strong",{},"注記","：GitLab上でホストされているGitリポジトリは、この脆弱性の影響を受けません。HTTPSやSSH経由のクローンでは、ローカルの設定ファイルが転送されないためです。",[53,54,55,60],"blockquote",{},[13,56,57],{},[48,58,59],{},"要点",[61,62,63,70,83],"ul",{},[64,65,66,69],"li",{},[48,67,68],{},"深刻な脆弱性"," GitLabの脅威リサーチグループは、AI支援開発向けのデスクトップGitクライアントDeepSeek-Reasonix Studioに、深刻なコマンド実行の脆弱性を発見しました。特定のリポジトリ設定の条件下で、デベロッパーがファイルの差分を表示すると、攻撃者が用意したコードが動くおそれがあります。",[64,71,72,75,76,79,80,82],{},[48,73,74],{},"根本原因"," DeepSeek-Reasonix独自のgitラッパーは、いくつかのgit設定キーをコマンドインジェクションから保護しています。しかし塞ぎきれていない穴が1つあり、それをコード内のコメントがみずから名指ししていました。",[30,77,78],{},"filter.\u003Cdriver>.clean","です。このキーは固定の設定キーではなく、",[30,81,43],{},"を通じてgitがファイルごとに選択します。",[64,84,85,88,89,91],{},[48,86,87],{},"当面の推奨事項"," DeepSeek-Reasonix Studio 2.21.0、または",[30,90,32],{}," npm 1.39.3へアップデートしてください。gitを外部実行するツールを開発している場合は、脆弱なキーを1つ塞いで終わりにしないこと。呼び出しのたびに関連するキーをすべて上書きするか、gitのfilterおよびtextconvの仕組み（コミットや差分の生成前にファイル内容を変換するためのフック）の呼び出し自体を避けてください。",[93,94,95],"h2",{"id":95},"コーディングエージェントのアタックサーフェスが特殊な理由",[13,97,98,99,101,102,104,105,22,108,22,111,113],{},"コーディングエージェントは、デベロッパーが開いたディレクトリであれば、どこに対してもgitを実行します。そのとき読み込まれる",[30,100,39],{},"と",[30,103,43],{},"を書いたのは、リポジトリを開いたデベロッパーではなく、そのリポジトリを作った人物。gitの設定キーのうち、",[30,106,107],{},"core.fsmonitor, core.hooksPath",[30,109,110],{},"diff.external",[30,112,78],{},"といったものは、通常のgit操作の一部として、指定されたコマンドを実行します。素のgitクライアントについても、すでにこの点を扱ったアドバイザリーが出ています。",[13,115,116,117,120],{},"コーディングエージェントはそれぞれ独自の方法でgitをラップしているため、直近のインシデントの原因になったプリミティブだけを塞いで終わりにしがちです。DeepSeek-Reasonixの",[30,118,119],{},"internal/gitcmd","も、呼び出しのたびに4つのプリミティブを塞いでいました。塞がれずに残った1つは、コード内のコメントが自分で名指ししていたものです。",[93,122,123],{"id":123},"脆弱性の仕組み",[13,125,126,128,129,101,132,135,136,101,139,142,143,145,146,148],{},[30,127,119],{},"は、呼び出しのたびに",[30,130,131],{},"core.fsmonitor",[30,133,134],{},"maintenance.auto","を無効化し、差分の取得時には",[30,137,138],{},"--no-ext-diff",[30,140,141],{},"--no-textconv","を付与しますが、",[30,144,78],{},"には一切手を触れていません。このキーは固定のリストから選ばれるものではなく、",[30,147,43],{},"がファイルごとに指定するため、ほかのキーと同じようにdeny-listで塞ぐ、という手が使えません。",[13,150,151,152,155],{},"実際の呼び出しは、",[30,153,154],{},"desktop/workspace_changes.go","の次の箇所です。",[157,158,164],"pre",{"className":159,"code":161,"language":162,"meta":163},[160],"language-text","args := []string{\"-C\", base, \"diff\", \"--no-ext-diff\", \"--no-textconv\", \"--relative\", \"HEAD\", \"--\", filepath.FromSlash(rel)}\n","text","",[30,165,161],{"__ignoreMap":163},[13,167,168],{},"それでもcleanフィルターはここで動きます。差分の比較に必要なblobを生成する処理であり、この工程には上記のフラグがまったく効きません。",[170,171,172],"h3",{"id":172},"呼び出しチェーンの全体像",[13,174,175],{},"呼び出しの流れを順に追ってみます。",[177,178,179,199,205,217],"ol",{},[64,180,181,184,185,188,189,192,193,195,196,198],{},[48,182,183],{},"仕込み"," ",[30,186,187],{},"secret.bin","には、",[30,190,191],{},"pwn","という名前のフィルタードライバーを割り当てる",[30,194,43],{},"のエントリーが付いています。そしてリポジトリの",[30,197,39],{},"が、そのドライバーのcleanコマンドとして攻撃者の選んだスクリプトを定義します。",[64,200,201,204],{},[48,202,203],{},"差分ビューが開かれる"," デベロッパーが、DeepSeek-Reasonixのデスクトップアプリでそのファイルの差分を開きます。コミットしていない変更があるファイルなら、ごく普通の操作です。",[64,206,207,184,210,212,213,216],{},[48,208,209],{},"DeepSeek-Reasonixが堅牢化済みのコマンドを実行する",[30,211,154],{},"が",[30,214,215],{},"git -c core.fsmonitor=false -c maintenance.auto=false -C \u003Crepo> diff --no-ext-diff --no-textconv -- secret.bin","を発行します。既存の堅牢化フラグはすべて揃った状態です。",[64,218,219,222,223,226],{},[48,220,221],{},"それでもcleanフィルターが動く"," gitは比較用のblobを作るために",[30,224,225],{},"filter.pwn.clean","を呼び出しますが、これはどのフラグも及ばない工程です。攻撃者のコマンドは、差分の両側に対して1回ずつ実行されます。",[13,228,229,230,233],{},"堅牢化済みのコマンドを再現したところ、ペイロードは2回実行されました。diffは比較の両側についてcleanフィルターを通したblobを作るため、フィルターが片側ごとに1回ずつ発火します。一方",[30,231,232],{},"git status","が確認するのは、どのファイルが変更されたかという点だけ。blobを作らないので、フィルターにも触れません。つまりこの不具合は差分の描画に限定されており、DeepSeek-Reasonixの実際のコードパスとも一致します。",[170,235,236],{"id":236},"影響範囲",[13,238,239,241,242,244,245,248,249,252],{},[30,240,43],{},"はクローンしても残りますが、",[30,243,39],{},"は残りません。攻撃を届けるには、アーカイブ、同期フォルダー、CIキャッシュ、devcontainerのビルドといった経路が必要になります。検証はコミット",[30,246,247],{},"ea28602","と、プレリリースのタグ",[30,250,251],{},"studio-v2.9.0","で実施しました。影響はデスクトップアプリとnpmパッケージの両方に及びます。",[13,254,255,256,258],{},"ただし、エージェント型ツールに固有の、より直接的な経路もあります。デベロッパーのマシンですでに動いているコーディングエージェントが、不正なものだったり、侵害されていたり、プロンプトインジェクションを受けていたりすれば、そのエージェントはデベロッパー自身と同じファイルシステムへのアクセス権を持ちます。ごく普通にクローンしただけのリポジトリに、汚染された",[30,257,39],{},"を直接書き込めてしまう。アーカイブも同期フォルダーもCIキャッシュも要りません。",[93,260,261],{"id":261},"新しいツールが古いバグを引き継ぐ理由",[13,263,264],{},"ここまでの話は、DeepSeek-Reasonixに限りません。",[61,266,267,278],{},[64,268,269,272,273,40,275,277],{},[48,270,271],{},"リポジトリの設定が、ツール自身の設定として扱われてしまう"," コーディングエージェントは",[30,274,39],{},[30,276,43],{},"を自分の設定であるかのように読み込みますが、その中身を決めているのはリポジトリの作者です。これらのファイルはコードのすぐ隣に置かれ、見た目にもコードの一部のように思えるため、この区別は見落とされがちです。",[64,279,280,283,284,289,290,293],{},[48,281,282],{},"同じ信頼の崩れを、別のファイルですでに見ている"," 今年の初めにも、GitLabの脅威リサーチグループは",[17,285,288],{"href":286,"rel":287},"https://about.gitlab.com/ja-jp/blog/critical-rce-in-serena/",[],"Serenaで同じパターンを発見","しました。別のAIコーディングツールであるSerenaは、デベロッパーがリポジトリを開いた際に、プロジェクト自身の設定ファイル",[30,291,292],{},".serena/project.yml","から攻撃者のコードを実行していました。どちらの事例も、リポジトリの作者が中身を決められるファイルをツールが信頼してしまったという点で共通しています。同じ誤りは、ほかのエージェント型ツールでも見つかるとみています。",[93,295,297],{"id":296},"今何をすべきか","今、何をすべきか",[170,299,301],{"id":300},"deepseek-reasonixを利用している場合","DeepSeek-Reasonixを利用している場合",[13,303,304,305,307],{},"Studio 2.21.0、または",[30,306,32],{}," npm 1.39.3へアップデートしてください。それ以前のバージョンを使い続ける場合は、自分で直接クローンしたのではないリポジトリの差分を開かないようにしてください。",[170,309,311],{"id":310},"gitをラップするツールを開発している場合","Gitをラップするツールを開発している場合",[13,313,314],{},"ここからの推奨事項は、自分の管理下にないディレクトリに対してgitを外部実行するすべてのツールに当てはまります。",[61,316,317,331,363,375,378],{},[64,318,319,320,40,323,326,327,330],{},"バイト単位の内容だけが必要なら、",[30,321,322],{},"git cat-file",[30,324,325],{},"git show","でblobを読み、",[30,328,329],{},"diff in-process","を使ってください。",[64,332,333,334,22,336,22,339,22,342,22,345,22,347,350,351,22,353,356,357,101,359,362],{},"どうしても外部実行が必要なら、呼び出しのたびに関連するキーをすべて上書きします。対象は",[30,335,131],{},[30,337,338],{},"core.pager",[30,340,341],{},"core.editor",[30,343,344],{},"core.hooksPath",[30,346,110],{},[30,348,349],{},"core.sshCommand","、そして",[30,352,43],{},[30,354,355],{},".git/info/attributes","、グローバルおよびシステムの設定ファイルに現れるすべてのドライバー名に対する",[30,358,78],{},[30,360,361],{},"smudge","です。",[64,364,365,366,368,369,371,372,374],{},"あるフラグが別のフラグを兼ねることはありません。",[30,367,138],{},"が効くのは",[30,370,110],{},"に対してのみ。",[30,373,349],{},"には何の効果もありません。",[64,376,377],{},"汚染された設定がリポジトリと一緒に届くとは限りません。デベロッパー本人と同じ権限で動いている別のエージェントや拡張機能、プロセスが、クローン済みのリポジトリへ直接書き込むこともできます。",[64,379,380],{},"出荷前に、意図的に敵対的な設定の組み合わせを用意してテストしてください。",[170,382,383],{"id":383},"セキュリティチームを率いている場合",[13,385,386],{},"デベロッパーのマシン上でgitを外部実行するツールは、そのデベロッパーが持つ権限のすべてを使って動きます。ベンダーに確認すべきは、信頼できないリモートへの対処だけではありません。リポジトリローカルの設定をどう無効化しているかも、あわせて尋ねてください。",[93,388,389],{"id":389},"開示タイムライン",[391,392,393,407],"table",{},[394,395,396],"thead",{},[397,398,399,404],"tr",{},[400,401,403],"th",{"align":402},"left","日付",[400,405,406],{"align":402},"内容",[408,409,410,419,427,439],"tbody",{},[397,411,412,416],{},[413,414,415],"td",{"align":402},"2026-08-27",[413,417,418],{"align":402},"esengineとアドバイザリーを起票",[397,420,421,424],{},[413,422,423],{"align":402},"2026-09-29",[413,425,426],{"align":402},"esengineが一時的な非公開フォークを作成し、報告を受理",[397,428,429,432],{},[413,430,431],{"align":402},"2026-09-30",[413,433,434,435,438],{"align":402},"修正版をリリース（Studio 2.21.0 / npm 1.39.3）。アドバイザリーを公開（",[17,436,21],{"href":19,"rel":437},[],"）",[397,440,441,443],{},[413,442,431],{"align":402},[413,444,445],{"align":402},"CVE-2026-102437を採番",[13,447,448],{},"報告を受け入れ、修正版をリリースしてくださったDeepSeek-Reasonixのメンテナーの皆様に感謝いたします。",[93,450,452],{"id":451},"gitlabにできること","GitLabにできること",[13,454,455,456,461],{},"自分のコードベースに同じパターンがないかを調べるなら、",[17,457,460],{"href":458,"rel":459},"https://docs.gitlab.com/ja-jp/user/duo_agent_platform/agents/foundational_agents/security_analyst_agent/",[],"GitLab Duo Agent Platformのセキュリティ分析エージェント","が役立ちます。まずは次のように問いかけてみてください。",[157,463,466],{"className":464,"code":465,"language":162,"meta":163},[160],"「このコードは、自分の管理下にないディレクトリに対してgitを外部実行していないか。また、実行前に `core.hooksPath, filter.*.clean`、`diff.external` を無効化しているか」\n",[30,467,465],{"__ignoreMap":163},[13,469,470],{},"エージェントが、自社環境への影響を評価します。",[93,472,473],{"id":473},"今後の展望",[13,475,476,479],{},[48,477,478],{},"リスクを知っていることと、それを塞ぐことは、必ずしも同じではありません","。きちんと記録され、正直に認識されていたセキュリティ上の穴であっても、そのまま出荷されてしまう。今回のDeepSeek-Reasonixの経緯は、その事実をあらためて思い出させてくれます。同じパターンは、広く使われているほかのエージェント型ツールにも存在しており、現在は協調的な開示の手続きを進めている段階。修正が用意でき次第、それぞれの詳細を公開します。",[53,481,482],{},[13,483,484],{},[17,485,488],{"href":486,"rel":487},"https://about.gitlab.com/ja-jp/blog/categories/security-labs/",[],"GitLabの脅威リサーチグループによるセキュリティリサーチの記事をさらに読む",{"title":163,"searchDepth":490,"depth":490,"links":491},2,[492,493,498,499,504,505,506],{"id":95,"depth":490,"text":95},{"id":123,"depth":490,"text":123,"children":494},[495,497],{"id":172,"depth":496,"text":172},3,{"id":236,"depth":496,"text":236},{"id":261,"depth":490,"text":261},{"id":296,"depth":490,"text":297,"children":500},[501,502,503],{"id":300,"depth":496,"text":301},{"id":310,"depth":496,"text":311},{"id":383,"depth":496,"text":383},{"id":389,"depth":490,"text":389},{"id":451,"depth":490,"text":452},{"id":473,"depth":490,"text":473},"security-labs","2026-10-02","GitLabの脅威リサーチグループは、ファイルの差分を表示しただけで攻撃者のコードが動く脆弱性ConfigPoisoningをDeepSeek-Reasonixで発見しました。","md",null,true,"https://res.cloudinary.com/about-gitlab-com/image/upload/v1782237704/cj50chkvprjthczevmog.png",{},"/ja-jp/blog/deepseek-reasonix-vulnerability-discovered",{"config":517,"title":5,"description":509},{"noIndex":518},false,"deepseek-reasonix-vulnerability-discovered","ja-jp/blog/deepseek-reasonix-vulnerability-discovered",[522,523],"security","security research","BlogPost","2026-10-06","e69WhDx_vInByO_2TB8X3MOfvlWRDNZUbDnK6ADWnww",{"logo":528,"freeTrial":533,"sales":538,"login":543,"items":548,"search":879,"minimal":912,"duo":930,"switchNav":939,"pricingDeployment":950},{"config":529},{"href":530,"dataGaName":531,"dataGaLocation":532},"/ja-jp/","gitlab logo","header",{"text":534,"config":535},"無料トライアルを開始",{"href":536,"dataGaName":537,"dataGaLocation":532},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com/ja-jp&glm_content=default-saas-trial/","free trial",{"text":539,"config":540},"デモをリクエスト",{"href":541,"dataGaName":542,"dataGaLocation":532},"/request-a-demo/","sales",{"text":544,"config":545},"サインイン",{"href":546,"dataGaName":547,"dataGaLocation":532},"https://gitlab.com/users/sign_in/","sign in",[549,635,723,728,803,857],{"text":550,"left":512,"config":551,"menu":553},"プラットフォーム",{"dataNavLevelOne":552},"platform",{"type":554,"link":555,"columns":559,"feature":624},"lists",{"text":556,"config":557},"プラットフォームを詳しく見る",{"href":558,"dataGaName":552,"dataGaLocation":532},"/ja-jp/platform/",[560,583,606],{"title":561,"items":562},"実行とワークフロー",[563,568,573,578],{"text":564,"config":565},"CI/CD",{"href":566,"dataGaLocation":532,"dataGaName":567},"/ja-jp/solutions/continuous-integration/","ci/cd",{"text":569,"config":570},"ソースコード管理",{"href":571,"dataGaLocation":532,"dataGaName":572},"/ja-jp/solutions/source-code-management/","source code management",{"text":574,"config":575},"アジャイルデリバリー",{"href":576,"dataGaLocation":532,"dataGaName":577},"/ja-jp/solutions/agile-delivery/","agile delivery",{"text":579,"config":580},"アーティファクト管理",{"href":581,"dataGaLocation":532,"dataGaName":582},"/ja-jp/artifact-central/","artifact management",{"title":584,"items":585},"セキュリティとガバナンス",[586,591,596,601],{"text":587,"config":588},"アプリケーションセキュリティテスト",{"href":589,"dataGaLocation":532,"dataGaName":590},"/ja-jp/solutions/application-security-testing/","application security testing",{"text":592,"config":593},"ガバナンスとコンプライアンス",{"href":594,"dataGaLocation":532,"dataGaName":595},"/ja-jp/solutions/software-compliance/","governance and compliance",{"text":597,"config":598},"シークレット管理",{"href":599,"dataGaLocation":532,"dataGaName":600},"/ja-jp/gitlab-secrets-manager/","secrets management",{"text":602,"config":603},"サプライチェーンセキュリティ",{"href":604,"dataGaLocation":532,"dataGaName":605},"/ja-jp/solutions/supply-chain/","supply chain security",{"title":607,"items":608},"コンテキストとAI",[609,614,619],{"text":610,"config":611},"エージェント型オーケストレーション",{"href":612,"dataGaLocation":532,"dataGaName":613},"/ja-jp/gitlab-duo-agent-platform/","agentic orchestration",{"text":615,"config":616},"コンテキストグラフ",{"href":617,"dataGaLocation":532,"dataGaName":618},"/ja-jp/gitlab-orbit/","context graph",{"text":620,"config":621},"可視性と測定",{"href":622,"dataGaLocation":532,"dataGaName":623},"/ja-jp/solutions/visibility-measurement/","visibility and measurement",{"config":625,"title":628,"text":629,"link":630},{"background":626,"textColor":627},"url('https://res.cloudinary.com/about-gitlab-com/image/upload/v1790185102/o7dn32anqcb6z8dgd3as.jpg')","#000","GitLabが選ばれる理由","ひとつのプラットフォームで、ソフトウェアライフサイクル全体を通じてスピードと制御を両立できます。",{"text":631,"config":632},"詳細はこちら",{"href":633,"dataGaName":634,"dataGaLocation":532},"/ja-jp/why-gitlab/","why gitlab",{"text":636,"left":512,"config":637,"menu":639},"ソリューション",{"dataNavLevelOne":638},"solutions",{"type":554,"link":640,"columns":644,"feature":714},{"text":641,"config":642},"すべてのソリューションを表示",{"href":643,"dataGaName":638,"dataGaLocation":532},"/ja-jp/solutions/",[645,663,681],{"title":646,"items":647},"成果",[648,653,658],{"text":649,"config":650},"DevOpsモダナイゼーション",{"href":651,"dataGaLocation":532,"dataGaName":652},"/ja-jp/assessments/devops-modernization-assessment/","devops modernization",{"text":654,"config":655},"セキュリティモダナイゼーション",{"href":656,"dataGaLocation":532,"dataGaName":657},"/ja-jp/assessments/security-modernization-assessment/","security modernization",{"text":659,"config":660},"AIモダナイゼーション",{"href":661,"dataGaLocation":532,"dataGaName":662},"/ja-jp/assessments/ai-modernization-assessment/","ai modernization",{"title":664,"items":665},"規模別",[666,671,676],{"text":667,"config":668},"エンタープライズ",{"href":669,"dataGaLocation":532,"dataGaName":670},"/ja-jp/enterprise/","enterprise",{"text":672,"config":673},"スモールビジネス",{"href":674,"dataGaLocation":532,"dataGaName":675},"/ja-jp/small-business/","small business",{"text":677,"config":678},"スタートアップ",{"href":679,"dataGaLocation":532,"dataGaName":680},"/ja-jp/solutions/startups/","startups",{"title":682,"items":683},"業界",[684,689,694,699,704,709],{"text":685,"config":686},"金融サービス",{"href":687,"dataGaLocation":532,"dataGaName":688},"/ja-jp/solutions/finance/","financial services",{"text":690,"config":691},"公共部門",{"href":692,"dataGaLocation":532,"dataGaName":693},"/ja-jp/solutions/public-sector/","public sector",{"text":695,"config":696},"通信",{"href":697,"dataGaLocation":532,"dataGaName":698},"/ja-jp/solutions/telecommunications/","telecommunications",{"text":700,"config":701},"自動車",{"href":702,"dataGaLocation":532,"dataGaName":703},"/ja-jp/solutions/automotive/","automotive",{"text":705,"config":706},"教育",{"href":707,"dataGaLocation":532,"dataGaName":708},"/ja-jp/solutions/education/","education",{"text":710,"config":711},"航空宇宙",{"href":712,"dataGaLocation":532,"dataGaName":713},"/ja-jp/solutions/aerospace/","aerospace",{"config":715,"title":716,"text":717,"link":718},{"background":626,"textColor":627},"GitLabのセキュリティ標準","セキュリティを犠牲にすることなく、ソフトウェアファクトリーを強化し、自律的なAIエージェントを実現する方法をご覧ください。",{"text":719,"config":720},"標準を見る",{"href":721,"dataGaName":722,"dataGaLocation":532},"/ja-jp/gitlab-security-standard/","gitlab security standard",{"text":724,"config":725},"価格",{"href":726,"dataGaName":727,"dataGaLocation":532,"dataNavLevelOne":727},"/ja-jp/pricing/","pricing",{"text":729,"config":730,"menu":732},"関連リソース",{"dataNavLevelOne":731},"resources",{"type":554,"link":733,"columns":737,"feature":794},{"text":734,"config":735},"すべてのリソースを表示",{"href":736,"dataGaName":731,"dataGaLocation":532},"/ja-jp/resources/",[738,766],{"title":739,"items":740},"検索する",[741,746,751,756,761],{"text":742,"config":743},"製品ドキュメント",{"href":744,"dataGaName":745,"dataGaLocation":532},"https://docs.gitlab.com/ja-jp/","docs",{"text":747,"config":748},"GitLab University",{"href":749,"dataGaName":750,"dataGaLocation":532},"https://university.gitlab.com/","university",{"text":752,"config":753},"技術デモ",{"href":754,"dataGaName":755,"dataGaLocation":532},"/ja-jp/gitlab-technical-demo-series/","demo series",{"text":757,"config":758},"インタラクティブデモ",{"href":759,"dataGaName":760,"dataGaLocation":532},"/ja-jp/demo-hub/","demo hub",{"text":762,"config":763},"GitLabサービス",{"href":764,"dataGaName":765,"dataGaLocation":532},"/ja-jp/services/","services",{"title":767,"items":768},"つなげる",[769,774,779,784,789],{"text":770,"config":771},"ブログ",{"href":772,"dataGaName":773,"dataGaLocation":532},"/ja-jp/blog/","blog",{"text":775,"config":776},"コミュニティ",{"href":777,"dataGaName":778,"dataGaLocation":532},"/community/","community",{"text":780,"config":781},"お客様事例",{"href":782,"dataGaName":783,"dataGaLocation":532},"/ja-jp/customers/","customers",{"text":785,"config":786},"パートナー",{"href":787,"dataGaName":788,"dataGaLocation":532},"/ja-jp/partners/","partners",{"text":790,"config":791},"イベント",{"href":792,"dataGaName":793,"dataGaLocation":532},"/events/","events",{"config":795,"title":796,"text":797,"link":798},{"background":626,"textColor":627},"GitLabの最新情報","最新の機能と改善点に関する情報をお届けします。",{"text":799,"config":800},"最新情報を読む",{"href":801,"dataGaName":802,"dataGaLocation":532},"/ja-jp/whats-new/","whats new",{"text":804,"config":805,"menu":807},"企業情報",{"dataNavLevelOne":806},"company",{"type":554,"columns":808},[809],{"items":810},[811,816,822,827,832,837,842,847,852],{"text":812,"config":813},"GitLabについて",{"href":814,"dataGaName":815,"dataGaLocation":532},"/ja-jp/company/","about",{"text":817,"config":818,"footerGa":821},"採用情報",{"href":819,"dataGaName":820,"dataGaLocation":532},"/jobs/","jobs",{"dataGaName":820},{"text":823,"config":824},"プレス",{"href":825,"dataGaName":826,"dataGaLocation":532},"/press/","press",{"text":828,"config":829},"ハンドブック",{"href":830,"dataGaName":831,"dataGaLocation":532},"https://handbook.gitlab.com/","handbook",{"text":833,"config":834},"経営陣",{"href":835,"dataGaName":836,"dataGaLocation":532},"/company/team/e-group/","leadership",{"text":838,"config":839},"投資家向け情報",{"href":840,"dataGaName":841,"dataGaLocation":532},"https://ir.gitlab.com/overview/default.aspx","investor relations",{"text":843,"config":844},"トラストセンター",{"href":845,"dataGaName":846,"dataGaLocation":532},"/ja-jp/security/","trust center",{"text":848,"config":849},"AI Transparency Center",{"href":850,"dataGaName":851,"dataGaLocation":532},"/ja-jp/ai-transparency-center/","ai transparency center",{"text":853,"config":854},"ニュースレター",{"href":855,"dataGaName":856,"dataGaLocation":532},"/company/contact/#contact-forms","newsletter",{"text":858,"config":859,"menu":860},"お問い合わせ",{"dataNavLevelOne":806},{"type":554,"columns":861},[862],{"items":863},[864,869,874],{"text":865,"config":866},"お問い合わせはこちら",{"href":867,"dataGaName":868,"dataGaLocation":532},"/ja-jp/sales/","talk to sales",{"text":870,"config":871},"サポートポータル",{"href":872,"dataGaName":873,"dataGaLocation":532},"https://support.gitlab.com/hc/en-us","support portal",{"text":875,"config":876},"カスタマーポータル",{"href":877,"dataGaName":878,"dataGaLocation":532},"https://customers.gitlab.com/customers/sign_in/","customer portal",{"close":880,"login":881,"suggestions":888},"閉じる",{"text":882,"link":883},"リポジトリとプロジェクトを検索するには、次にログインします",{"text":884,"config":885},"GitLab.com",{"href":546,"dataGaName":886,"dataGaLocation":887},"search login","search",{"text":889,"default":890},"提案",[891,894,898,900,904,908],{"text":892,"config":893},"GitLab Duo Agent Platform",{"href":612,"dataGaName":892,"dataGaLocation":887},{"text":895,"config":896},"コード提案（AI）",{"href":612,"dataGaName":897,"dataGaLocation":887},"Code Suggestions (AI)",{"text":564,"config":899},{"href":566,"dataGaName":564,"dataGaLocation":887},{"text":901,"config":902},"GitLab on AWS",{"href":903,"dataGaName":901,"dataGaLocation":887},"/ja-jp/partners/technology-partners/aws/",{"text":905,"config":906},"GitLab on Google Cloud",{"href":907,"dataGaName":905,"dataGaLocation":887},"/ja-jp/partners/technology-partners/google-cloud-platform/",{"text":909,"config":910},"GitLabを選ぶ理由",{"href":633,"dataGaName":911,"dataGaLocation":887},"Why GitLab?",{"freeTrial":913,"mobileIcon":917,"desktopIcon":922,"secondaryButton":925},{"text":534,"config":914},{"href":915,"dataGaName":537,"dataGaLocation":916},"https://gitlab.com/-/trials/new/","nav",{"altText":918,"config":919},"GitLabアイコン",{"src":920,"dataGaName":921,"dataGaLocation":916},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203874/jypbw1jx72aexsoohd7x.svg","gitlab icon",{"altText":918,"config":923},{"src":924,"dataGaName":921,"dataGaLocation":916},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203875/gs4c8p8opsgvflgkswz9.svg",{"text":926,"config":927},"はじめに",{"href":928,"dataGaName":929,"dataGaLocation":916},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com/ja-jp/get-started/","get started",{"freeTrial":931,"mobileIcon":935,"desktopIcon":937},{"text":932,"config":933},"GitLab Duoの詳細はこちら",{"href":612,"dataGaName":934,"dataGaLocation":916},"gitlab duo",{"altText":918,"config":936},{"src":920,"dataGaName":921,"dataGaLocation":916},{"altText":918,"config":938},{"src":924,"dataGaName":921,"dataGaLocation":916},{"button":940,"mobileIcon":945,"desktopIcon":947},{"text":941,"config":942},"/switch",{"href":943,"dataGaName":944,"dataGaLocation":916},"#contact","switch",{"altText":918,"config":946},{"src":920,"dataGaName":921,"dataGaLocation":916},{"altText":918,"config":948},{"src":949,"dataGaName":921,"dataGaLocation":916},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1773335277/ohhpiuoxoldryzrnhfrh.png",{"freeTrial":951,"mobileIcon":956,"desktopIcon":958},{"text":952,"config":953},"料金ページに戻る",{"href":726,"dataGaName":954,"dataGaLocation":916,"icon":955},"back to pricing","GoBack",{"altText":918,"config":957},{"src":920,"dataGaName":921,"dataGaLocation":916},{"altText":918,"config":959},{"src":924,"dataGaName":921,"dataGaLocation":916},{"title":961,"titleMobile":962,"button":963,"config":966},"GitLab Orbitが登場: AIエージェントのためのコンテキストレイヤー","GitLab Orbitが登場",{"text":631,"config":964},{"href":617,"dataGaName":965,"dataGaLocation":532},"orbit",{"layout":967,"disabled":518},"release",{"data":969},{"text":970,"source":971,"edit":977,"contribute":982,"config":987,"items":992,"minimal":1214},"GitはSoftware Freedom Conservancyの商標です。当社は「GitLab」をライセンスに基づいて使用しています",{"text":972,"config":973},"ページのソースを表示",{"href":974,"dataGaName":975,"dataGaLocation":976},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/","page source","footer",{"text":978,"config":979},"このページを編集",{"href":980,"dataGaName":981,"dataGaLocation":976},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/content/","web ide",{"text":983,"config":984},"ご協力をお願いします",{"href":985,"dataGaName":986,"dataGaLocation":976},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/CONTRIBUTING.md/","please contribute",{"twitter":988,"facebook":989,"youtube":990,"linkedin":991},"https://twitter.com/gitlab","https://www.facebook.com/gitlab","https://www.youtube.com/channel/UCnMGQ8QHMAnVIsI3xJrihhg","https://www.linkedin.com/company/gitlab-com",[993,1039,1096,1138,1181],{"title":724,"links":994,"subMenu":1009},[995,999,1004],{"text":996,"config":997},"プランの表示",{"href":726,"dataGaName":998,"dataGaLocation":976},"view plans",{"text":1000,"config":1001},"Premiumを選ぶ理由",{"href":1002,"dataGaName":1003,"dataGaLocation":976},"/ja-jp/pricing/premium/","why premium",{"text":1005,"config":1006},"Ultimateを選ぶ理由",{"href":1007,"dataGaName":1008,"dataGaLocation":976},"/ja-jp/pricing/ultimate/","why ultimate",[1010],{"title":858,"links":1011},[1012,1015,1017,1019,1024,1029,1034],{"text":1013,"config":1014},"営業担当へのお問い合わせ",{"href":867,"dataGaName":542,"dataGaLocation":976},{"text":870,"config":1016},{"href":872,"dataGaName":873,"dataGaLocation":976},{"text":875,"config":1018},{"href":877,"dataGaName":878,"dataGaLocation":976},{"text":1020,"config":1021},"ステータス",{"href":1022,"dataGaName":1023,"dataGaLocation":976},"https://status.gitlab.com/","status",{"text":1025,"config":1026},"利用規約",{"href":1027,"dataGaName":1028,"dataGaLocation":976},"/terms/","terms of use",{"text":1030,"config":1031},"プライバシーに関する声明",{"href":1032,"dataGaName":1033,"dataGaLocation":976},"/ja-jp/privacy/","privacy statement",{"text":1035,"config":1036},"Cookie設定",{"dataGaName":1037,"dataGaLocation":976,"id":1038,"isOneTrustButton":512},"cookie preferences","ot-sdk-btn",{"title":550,"links":1040,"subMenu":1053},[1041,1043,1045,1047,1049,1051],{"text":556,"config":1042},{"href":558,"dataGaName":552,"dataGaLocation":976},{"text":610,"config":1044},{"href":612,"dataGaName":613,"dataGaLocation":976},{"text":564,"config":1046},{"href":566,"dataGaName":567,"dataGaLocation":976},{"text":615,"config":1048},{"href":617,"dataGaName":618,"dataGaLocation":976},{"text":597,"config":1050},{"href":599,"dataGaName":600,"dataGaLocation":976},{"text":628,"config":1052},{"href":633,"dataGaName":634,"dataGaLocation":976},[1054],{"title":1055,"links":1056},"トピック",[1057,1061,1066,1071,1076,1081,1086,1091],{"text":564,"config":1058},{"href":1059,"dataGaName":1060,"dataGaLocation":976},"/ja-jp/topics/ci-cd/","cicd",{"text":1062,"config":1063},"GitOps",{"href":1064,"dataGaName":1065,"dataGaLocation":976},"/ja-jp/topics/gitops/","gitops",{"text":1067,"config":1068},"DevOps",{"href":1069,"dataGaName":1070,"dataGaLocation":976},"/ja-jp/topics/devops/","devops",{"text":1072,"config":1073},"バージョン管理",{"href":1074,"dataGaName":1075,"dataGaLocation":976},"/ja-jp/topics/version-control/","version control",{"text":1077,"config":1078},"DevSecOps",{"href":1079,"dataGaName":1080,"dataGaLocation":976},"/ja-jp/topics/devsecops/","devsecops",{"text":1082,"config":1083},"クラウドネイティブ",{"href":1084,"dataGaName":1085,"dataGaLocation":976},"/ja-jp/topics/cloud-native/","cloud native",{"text":1087,"config":1088},"コーディングのためのAI",{"href":1089,"dataGaName":1090,"dataGaLocation":976},"/ja-jp/topics/devops/ai-for-coding/","ai for coding",{"text":1092,"config":1093},"エージェント型AI",{"href":1094,"dataGaName":1095,"dataGaLocation":976},"/ja-jp/topics/agentic-ai/","agentic ai",{"title":636,"links":1097},[1098,1100,1102,1104,1106,1109,1111,1113,1115,1117,1119,1121,1123,1126,1130,1134],{"text":649,"config":1099},{"href":651,"dataGaName":652,"dataGaLocation":976},{"text":654,"config":1101},{"href":656,"dataGaName":657,"dataGaLocation":976},{"text":659,"config":1103},{"href":661,"dataGaName":662,"dataGaLocation":976},{"text":685,"config":1105},{"href":687,"dataGaName":688,"dataGaLocation":976},{"text":1107,"config":1108},"公共機関",{"href":692,"dataGaName":693,"dataGaLocation":976},{"text":695,"config":1110},{"href":697,"dataGaName":698,"dataGaLocation":976},{"text":700,"config":1112},{"href":702,"dataGaName":703,"dataGaLocation":976},{"text":705,"config":1114},{"href":707,"dataGaName":708,"dataGaLocation":976},{"text":710,"config":1116},{"href":712,"dataGaName":713,"dataGaLocation":976},{"text":667,"config":1118},{"href":669,"dataGaName":670,"dataGaLocation":976},{"text":672,"config":1120},{"href":674,"dataGaName":675,"dataGaLocation":976},{"text":677,"config":1122},{"href":679,"dataGaName":680,"dataGaLocation":976},{"text":1062,"config":1124},{"href":1125,"dataGaName":1065,"dataGaLocation":976},"/ja-jp/solutions/gitops/",{"text":1127,"config":1128},"ソフトウェアコンポジション解析",{"href":604,"dataGaName":1129,"dataGaLocation":976},"software composition analysis",{"text":1131,"config":1132},"バリューストリーム管理",{"href":622,"dataGaName":1133,"dataGaLocation":976},"value stream management",{"text":1135,"config":1136},"すべてのソリューション",{"href":643,"dataGaName":1137,"dataGaLocation":976},"all solutions",{"title":1139,"links":1140},"リソース",[1141,1146,1151,1154,1156,1158,1160,1162,1164,1166,1168,1170,1172,1174,1177],{"text":1142,"config":1143},"インストール",{"href":1144,"dataGaName":1145,"dataGaLocation":976},"/ja-jp/install/","install",{"text":1147,"config":1148},"クイックスタートガイド",{"href":1149,"dataGaName":1150,"dataGaLocation":976},"/ja-jp/get-started/","quick setup checklists",{"text":742,"config":1152},{"href":1153,"dataGaName":745,"dataGaLocation":976},"https://docs.gitlab.com/ja-jp",{"text":747,"config":1155},{"href":749,"dataGaName":750,"dataGaLocation":976},{"text":752,"config":1157},{"href":754,"dataGaName":755,"dataGaLocation":976},{"text":757,"config":1159},{"href":759,"dataGaName":760,"dataGaLocation":976},{"text":762,"config":1161},{"href":764,"dataGaName":765,"dataGaLocation":976},{"text":770,"config":1163},{"href":772,"dataGaName":773,"dataGaLocation":976},{"text":775,"config":1165},{"href":777,"dataGaName":778,"dataGaLocation":976},{"text":780,"config":1167},{"href":782,"dataGaName":783,"dataGaLocation":976},{"text":785,"config":1169},{"href":787,"dataGaName":788,"dataGaLocation":976},{"text":790,"config":1171},{"href":792,"dataGaName":793,"dataGaLocation":976},{"text":853,"config":1173},{"href":855,"dataGaName":856,"dataGaLocation":976},{"text":1175,"config":1176},"最新リリース",{"href":801,"dataGaName":802,"dataGaLocation":976},{"text":1178,"config":1179},"すべてのリソース",{"href":736,"dataGaName":1180,"dataGaLocation":976},"all resources",{"title":1182,"links":1183},"会社情報",[1184,1186,1188,1190,1192,1194,1196,1198,1200,1204,1209],{"text":812,"config":1185},{"href":814,"dataGaName":806,"dataGaLocation":976},{"text":817,"config":1187},{"href":819,"dataGaName":820,"dataGaLocation":976},{"text":823,"config":1189},{"href":825,"dataGaName":826,"dataGaLocation":976},{"text":828,"config":1191},{"href":830,"dataGaName":831,"dataGaLocation":976},{"text":833,"config":1193},{"href":835,"dataGaName":836,"dataGaLocation":976},{"text":838,"config":1195},{"href":840,"dataGaName":841,"dataGaLocation":976},{"text":843,"config":1197},{"href":845,"dataGaName":846,"dataGaLocation":976},{"text":848,"config":1199},{"href":850,"dataGaName":851,"dataGaLocation":976},{"text":1201,"config":1202},"Sustainability",{"href":1203,"dataGaName":1201,"dataGaLocation":976},"/sustainability/",{"text":1205,"config":1206},"ダイバーシティ、インクルージョン、ビロンギング（DIB）",{"href":1207,"dataGaName":1208,"dataGaLocation":976},"/ja-jp/diversity-inclusion-belonging/","Diversity, inclusion and belonging",{"text":1210,"config":1211},"現代奴隷制の透明性に関する声明",{"href":1212,"dataGaName":1213,"dataGaLocation":976},"https://handbook.gitlab.com/handbook/legal/modern-slavery-act-transparency-statement/","modern slavery transparency statement",{"items":1215},[1216,1218,1220],{"text":1025,"config":1217},{"href":1027,"dataGaName":1028,"dataGaLocation":976},{"text":1035,"config":1219},{"dataGaName":1037,"dataGaLocation":976,"id":1038,"isOneTrustButton":512},{"text":1030,"config":1221},{"href":1032,"dataGaName":1033,"dataGaLocation":976},[1223,1236],{"id":1224,"title":7,"body":511,"config":1225,"content":1227,"description":511,"extension":1230,"meta":1231,"navigation":512,"path":1232,"seo":1233,"stem":1234,"__hash__":1235},"blogAuthors/en-us/blog/authors/abisheik-magesh.yml",{"template":1226},"BlogAuthor",{"name":7,"config":1228},{"headshot":1229},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1787000354/gmgyvfesrvwdlvt52gdw.png","yml",{},"/en-us/blog/authors/abisheik-magesh",{},"en-us/blog/authors/abisheik-magesh","kPev_Acm8MB5tgKMnU_Rkfq1sl42e8DixU6iNMXXfxI",{"id":1237,"title":8,"body":511,"config":1238,"content":1240,"description":511,"extension":1230,"meta":1243,"navigation":512,"path":1244,"seo":1245,"stem":1246,"__hash__":1247},"blogAuthors/en-us/blog/authors/daniel-abeles.yml",{"template":1226,"gitlabHandle":1239},"dabeles",{"name":8,"config":1241},{"headshot":1242},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1786473980/kjzctsiwvfc6afimsdtc.jpg",{},"/en-us/blog/authors/daniel-abeles",{},"en-us/blog/authors/daniel-abeles","9j7gS6WI8857OrOR0VcnHZiFLXpZpnKFA3tgPdDU5hw",[1249,1255,1261],{"title":1250,"description":1251,"heroImage":513,"category":507,"date":1252,"authors":1253,"slug":1254,"externalUrl":511},"Node.jsサンドボックスライブラリvm2に、CVSS 10.0のリモートコード実行の脆弱性","GitLabの脅威リサーチグループは、Node.jsサンドボックスライブラリvm2に深刻なサンドボックス脱出の脆弱性を発見しました。公式ドキュメント記載の設定のまま、攻撃者のコードが実行されます。","2026-09-02",[7,8],"critical-remote-code-execution-in-vm2",{"title":1256,"description":1257,"heroImage":513,"category":507,"date":1258,"authors":1259,"slug":1260,"externalUrl":511},"MCPコーディングエージェントSerenaに重大なリモートコード実行の脆弱性","リポジトリを開いた瞬間に攻撃者のコードが動く。GitLabの脅威リサーチグループが、AIコーディングエージェントSerenaに重大なテンプレートインジェクションの脆弱性を発見しました。","2026-08-17",[8,7],"critical-rce-in-serena",{"title":1262,"description":1263,"heroImage":1264,"category":507,"date":1265,"authors":1266,"slug":1267,"externalUrl":511},"サンドボックスの閉鎖性は、AIエージェントが到達できる範囲で決まる","社内評価で行き詰まったAIエージェントは、許可リストに載っていた唯一のサービスの脆弱性を突き、わずか1時間でサンドボックスを脱出しました。エージェント時代の許可リスト設計に生じた死角と、テスト環境で到達範囲を絞るための4つの対策を解説します。","https://res.cloudinary.com/about-gitlab-com/image/upload/v1786468880/uxouffutvvwsbxzikhyc.png","2026-08-12",[8],"ai-agent-sandbox",{"header":1269,"text":1270,"button":1274,"disclaimer":1277},"無料の\n\n30日間のGitLabトライアルを開始\n",[1271,1272,1273],"GitLab Duo Agent Platformへのアクセス","GitLabの最も高度な機能を試す","AIで複雑なタスクを自動化する",{"text":534,"config":1275},{"href":1276,"dataGaName":537,"dataGaLocation":773},"https://gitlab.com/-/trials/new?glm_content=default-saas-trial&glm_source=about.gitlab.com/ja-jp/blog/","クレジットカードなしでご登録いただけます。",{"header":1279,"blurb":1280,"button":1281,"secondaryButton":1285},"今すぐ開発をスピードアップ","DevSecOpsに特化したインテリジェントオーケストレーションプラットフォームで実現できることをご確認ください。\n",{"text":534,"config":1282},{"href":1283,"dataGaName":537,"dataGaLocation":1284},"https://gitlab.com/-/trial_registrations/new?glm_content=default-saas-trial&glm_source=about.gitlab.com/ja-jp/","feature",{"text":858,"config":1286},{"href":867,"dataGaName":542,"dataGaLocation":1284},1791944950666]