CVE-2025-13761: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed an unauthenticated user to execute arbitrary code in the context of an authenticated user's browser by convincing the legitimate user to visit a specially crafted webpage.
Other sources
GitLab has remediated an issue that could have allowed an unauthenticated user to execute arbitrary code in the context of an authenticated user’s browser by convincing the legitimate user to visit a specially crafted webpage.
— GitLab
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 18.6.3Fixed in 18.7.1 - Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 18.6.3 - Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 18.7.1
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2025-13761?
CVE-2025-13761 is classified as a critical vulnerability due to its potential to allow arbitrary code execution.
How do I fix CVE-2025-13761?
To remediate CVE-2025-13761, upgrade to GitLab version 18.6.3 or 18.7.1 or later.
Who is affected by CVE-2025-13761?
CVE-2025-13761 affects users of GitLab versions between 18.6 and 18.6.3 and also 18.7 and 18.7.1.
Can an unauthenticated user exploit CVE-2025-13761?
Yes, CVE-2025-13761 allows an unauthenticated user to execute arbitrary code in the context of an authenticated user's session.
What should I do if I can't upgrade GitLab for CVE-2025-13761?
If you cannot upgrade GitLab to address CVE-2025-13761, you should implement additional network security measures to limit exposure.