GitLab CE/EE Cross-Site Scripting Vulnerability in Wiki Pages

A cross-site scripting vulnerability has been identified in GitLab Community Edition (CE) and Enterprise Edition (EE) versions 18.4 prior to 18.4.6, 18.5 prior to 18.5.4, and 18.6 prior to 18.6.2. Under certain conditions, this vulnerability allowed authenticated users to perform unauthorized actions on behalf of other users by creating wiki pages containing malicious content.

Impact

Exploitation of this vulnerability could lead to cross-site scripting, allowing for the injection of malicious scripts that could be executed in the context of the user's browser.

Remediation

Users are advised to upgrade to GitLab versions 18.6.2, 18.5.4, or 18.4.6. Instructions for updating GitLab can be found on the GitLab Update page. For GitLab Runner, refer to the Updating the Runner page.