Volerion logoVolerion
Volerion logoVolerion

GitLab CE/EE Cross-Site Scripting Vulnerability in Web IDE

Vulnerability

A cross-site scripting vulnerability has been identified in GitLab Community Edition (CE) and Enterprise Edition (EE) versions 18.6 prior to 18.6.3, and 18.7 prior to 18.7.1. This vulnerability could have allowed an unauthenticated user to execute arbitrary code in the context of an authenticated user's browser. The exploitation would involve convincing the legitimate user to visit a specially crafted webpage.

Impact

Exploitation of this vulnerability could lead to cross-site scripting, allowing for the execution of malicious scripts in the context of the user's session.

Remediation

Users are advised to upgrade to GitLab versions 18.7.1, 18.6.3, or 18.5.5. Instructions for updating GitLab can be found on the GitLab Update page.

Added: Jan 9, 2026, 10:32 AM
Updated: Jan 9, 2026, 10:32 AM

Vulnerability Rating

Custom Algorithm
spread
7.3
impact
1.7
exploitability
6.4
remediation
7.7
relevance
2.0
threat
0.0
urgency
2.9
incentive
1.7

Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.