GitLab VP here. We have a pre-assigned CVE id. I'm not sure whether I can share that. I'll update this post with anything I can share.

We'll likely publish some public statement on this on our blog post before Monday.

Edit: just to be clear. This is not a fake warning and we are releasing new versions on Monday.