CVE-2025-2254: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions from 17.9 before 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2. Improper output encoding in the snipper viewer functionality lead to Cross-Site scripting attacks.
Other sources
GitLab has remediated an issue that, under certain conditions, could have allowed a successful attacker to act in the context of a legitimate user by injecting a malicious script into the snippet viewer.Impacted versions GitLab CE/EE: all versions from 17.9 before 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2CVSS 8.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N)
— GitLab
Affected Software
Remediation
Information
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2025-2254?
CVE-2025-2254 is considered a high severity vulnerability due to its potential for enabling Cross-Site Scripting (XSS) attacks.
How do I fix CVE-2025-2254?
To fix CVE-2025-2254, upgrade your GitLab CE/EE instance to version 17.10.8 or later, 17.11.4 or later, or 18.0.2 or later.
What versions of GitLab are affected by CVE-2025-2254?
CVE-2025-2254 affects all versions of GitLab CE/EE from versions prior to 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2.
What is the impact of CVE-2025-2254?
The impact of CVE-2025-2254 is that it allows attackers to execute arbitrary JavaScript in users' browsers, potentially leading to data theft or account compromise.
Who is impacted by CVE-2025-2254?
Any users of GitLab CE/EE who are running affected versions prior to the patched releases are impacted by CVE-2025-2254.