CVE-2025-12734: Improper Encoding or Escaping of Output in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.6 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have allowed an authenticated user to, under certain conditions, render content in dialogs to other users by injecting malicious HTML content into merge request titles.
Other sources
GitLab has remediated an issue that could have allowed an authenticated user to, under certain conditions, render content in dialogs to other users by injecting malicious HTML content into merge request titles.
— GitLab
Affected Software
Remediation
Information
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2025-12734?
CVE-2025-12734 has been classified as a moderate severity vulnerability.
How do I fix CVE-2025-12734?
To remediate CVE-2025-12734, upgrade to GitLab versions 18.4.6, 18.5.4, or 18.6.2.
What kind of information could be leaked due to CVE-2025-12734?
CVE-2025-12734 could allow an authenticated user to leak sensitive information via specially crafted merge request titles.
Which versions of GitLab are affected by CVE-2025-12734?
Affected versions include any GitLab version between 15.6 and 18.4.6, as well as versions 18.5.4 and 18.6.2.
Is there any mitigation for CVE-2025-12734 if I cannot upgrade?
Currently, there are no known mitigations for CVE-2025-12734 besides upgrading to the secure versions.