GitLab EE Input Sanitization Vulnerability Allowing Cross-Site Scripting

A cross-site scripting vulnerability has been identified in GitLab EE, affecting all versions from 18.7 prior to 18.9.7, 18.10 prior to 18.10.6, and 18.11 prior to 18.11.3. The issue arises from improper input sanitization, which could have allowed an authenticated user to execute arbitrary JavaScript in the browsers of other users.

Impact

Exploitation of this vulnerability could lead to cross-site scripting, allowing for the execution of malicious scripts in the context of the user's browser.

Remediation

Users can upgrade to GitLab versions 18.9.7, 18.10.6, or 18.11.3 to address this vulnerability.