CVE-2025-0475: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions from 15.10 prior to 17.7.6, 17.8 prior to 17.8.4, and 17.9 prior to 17.9.1. A proxy feature could potentially allow unintended content rendering leading to XSS under specific circumstances.
Affected Software
Remediation
Information
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2025-0475?
CVE-2025-0475 is classified as a moderate severity vulnerability that can lead to cross-site scripting (XSS).
How do I fix CVE-2025-0475?
To fix CVE-2025-0475, upgrade GitLab CE/EE to version 17.7.6 or later, 17.8.4 or later, or 17.9.1 or later.
What products are affected by CVE-2025-0475?
CVE-2025-0475 affects GitLab CE/EE versions from 15.10 up to, but not including, 17.7.6, 17.8 up to, but not including, 17.8.4, and 17.9 up to, but not including, 17.9.1.
What exploit can occur due to CVE-2025-0475?
Due to CVE-2025-0475, an attacker may exploit the proxy feature to render unintended content, which can lead to cross-site scripting (XSS) attacks.
Is there a workaround for CVE-2025-0475 if I cannot upgrade?
Currently, the best mitigation for CVE-2025-0475 is to upgrade to a patched version of GitLab, as no official workarounds have been provided.