GitLab EE Code Injection Vulnerability in Code Quality Reports

A code injection vulnerability has been identified in GitLab Enterprise Edition (EE) versions 18.0.0 prior to 18.8.9, 18.9 prior to 18.9.5, and 18.10 prior to 18.10.3. This vulnerability could have allowed an authenticated user to leak the IP addresses of users viewing a Code Quality report by embedding specially crafted content.

Impact

Exploitation of this vulnerability could lead to unauthorized disclosure of IP addresses of users accessing the affected Code Quality reports.

Remediation

GitLab has released patch versions 18.10.3, 18.9.5, and 18.8.9. Users are strongly recommended to upgrade to these versions. Instructions for updating GitLab can be found in the GitLab Update documentation.