CVE-2025-2443: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
An issue has been discovered in GitLab EE that allows for cross-site-scripting attack and content security policy bypass in a user's browser under specific conditions, affecting all versions from 16.6 before 17.9.7, 17.10 before 17.10.5, and 17.11 before 17.11.1.
Other sources
An issue has been discovered in GitLab EE that allows for cross-site-scripting attack and content security policy bypass in a user’s browser under specific conditions, affecting all versions from 16.6 prior to 17.9.7, 17.10 prior to 17.10.5, and 17.11 prior to 17.11.1. This is a high severity issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N, 8.7). It is now mitigated in the latest release and is assigned CVE-2025-2443.
— GitLab
Affected Software
Remediation
Information
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2025-2443?
CVE-2025-2443 has a high severity level due to its potential for cross-site scripting attacks and content security policy bypass.
How do I fix CVE-2025-2443?
To fix CVE-2025-2443, upgrade GitLab EE to version 17.9.7 or later, or to version 17.10.5 or later, or to version 17.11.1 or later.
What versions are affected by CVE-2025-2443?
CVE-2025-2443 affects all versions of GitLab EE from 16.6 before 17.9.7, 17.10 before 17.10.5, and 17.11 before 17.11.1.
What kind of attacks can occur due to CVE-2025-2443?
CVE-2025-2443 allows for cross-site scripting attacks, which can exploit vulnerabilities in the user's browser.
How can I verify if my GitLab EE installation is vulnerable to CVE-2025-2443?
You can verify if your GitLab EE installation is vulnerable to CVE-2025-2443 by checking the version number against the specified affected versions.