Where
AND
AND
-Infinity
0
Severity
8
Command Injection, Input Validation
AV:L/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N

An issue was discovered in GitLab EE affecting all versions starting from 14.9 before 17.8.6, all versions starting from 17.9 before 17.8.3, all versions starting from 17.10 before 17.10.1. An input validation issue in the Harbor registry integration could have allowed a maintainer to add malicious code to the CLI commands shown in the UI.

1 / 2
Source: MITRE

Remedy

Upgrade to versions 17.8.6, 17.9.3, 17.10.1 or above.
First published (updated )
Severity
8.7
XSS
AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

An issue has been discovered in GitLab CE/EE affecting all versions from 17.7 before 17.8.6, 17.9 before 17.9.3, and 17.10 before 17.10.1. Improper rendering of certain file types leads to cross-site scripting.

1 / 2
Source: MITRE

Remedy

Upgrade to versions 17.8.6, 17.9.3, 17.10.1 or above.
First published (updated )
Severity
8.8
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

An improper access control vulnerability in GitLab CE/EE affecting all versions from 17.4 prior to 17.8.6, 17.9 prior to 17.9.3, and 17.10 prior to 17.10.1 allows a user who was an instance admin before but has since been downgraded to a regular user to continue to maintain elevated privileges to groups and projects.

1 / 2
Source: MITRE

Remedy

Upgrade to versions 17.8.6, 17.9.3, 17.10.1 or above.
First published (updated )
Severity
8.7
XSS
AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

An issue has been discovered in Gitlab EE/CE affecting all versions from 13.5.0 before 17.8.6, 17.9 before 17.9.3, and 17.10 before 17.10.1. Certain error messages could allow Cross-Site Scripting attacks (XSS). This is a high severity issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N, 8.7). It is now mitigated in the latest release and is assigned CVE-2025-2255.

1 / 2
Source: GitLab

Remedy

Upgrade to versions 17.8.6, 17.9.3, 17.10.1 or above.
First published (updated )
Severity
8.7
XSS
AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

An issue has been discovered in GitLab CE/EE affecting all versions from 17.9 before 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2. Improper output encoding in the snipper viewer functionality lead to Cross-Site scripting attacks.

1 / 2
Source: MITRE

Remedy

Upgrade to versions 17.10.8, 17.11.4, 18.0.2 or above.
First published (updated )
Severity
7.4
Command Injection, Input Validation
AV:L/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N

An issue was discovered in GitLab EE affecting all versions starting from 17.2 before 17.7.7, all versions starting from 17.8 before 17.8.5, all versions starting from 17.9 before 17.9.2. An input validation issue in the Google Cloud IAM integration feature could have enabled a Maintainer to introduce malicious code.

1 / 2
Source: MITRE

Remedy

Upgrade to versions 17.7.7, 17.8.5, 17.9.2.
First published (updated )
Severity
7.5
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

An issue was discovered in GitLab EE affecting all versions starting with 12.3 before 17.7.7, 17.8 prior to 17.8.5, and 17.9 prior to 17.9.2. A vulnerability in certain GitLab instances could allow an attacker to cause a denial of service condition by manipulating specific API inputs.

1 / 2
Source: MITRE

Remedy

Upgrade to version 17.9.2, 17.8.5, 17.7.7 or above.
First published (updated )
Severity
7.5
AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

An issue has been discovered in GitLab EE affecting all versions from 17.1 before 17.8.7, 17.9 before 17.9.6, and 17.10 before 17.10.4. This allows attackers to perform targeted searches with sensitive keywords to get the count of issues containing the searched term."

1 / 2
Source: MITRE

Remedy

Upgrade to version 17.10.4, 17.9.6, 17.8.7.
First published (updated )
Severity
7.5
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

A Denial of Service (DoS) issue has been discovered in GitLab CE/EE affecting all up to 17.8.7, 17.9 prior to 17.9.6 and 17.10 prior to 17.10.4 A denial of service could occur upon injecting oversized payloads into CI pipeline exports.

1 / 2
Source: MITRE

Remedy

Upgrade to version 17.10.4, 17.9.6 or 17.8.7
First published (updated )
Severity
7.5
AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N

An issue was discovered in GitLab EE/CE affecting all versions starting from 11.5 before 17.7.7, all versions starting from 17.8 before 17.8.5, all versions starting from 17.9 before 17.9.2. Certain user inputs in repository mirroring settings could potentially expose sensitive authentication information.

1 / 2
Source: MITRE

Remedy

Upgrade to version 17.9.2, 17.8.5, 17.7.7
First published (updated )
Severity
7.7
XSS
AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N

A Cross Site Scripting (XSS) vulnerability in GitLab-EE affecting all versions from 16.6 prior to 17.7.6, 17.8 prior to 17.8.4, and 17.9 prior to 17.9.1 allows an attacker to bypass security controls and execute arbitrary scripts in a user’s browser under specific conditions. This is a high severity issue (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N, 7.7). It is now mitigated in the latest release and is assigned CVE-2025-0555.

1 / 2
Source: GitLab

Remedy

Upgrade to versions 17.7.6, 17.8.4, 17.9.1 or above.
First published (updated )
Severity
8.7
XSS
AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

An issue has been discovered in GitLab CE/EE affecting all versions from 15.10 prior to 17.7.6, 17.8 prior to 17.8.4, and 17.9 prior to 17.9.1. A proxy feature could potentially allow unintended content rendering leading to XSS under specific circumstances.

1 / 2
Source: MITRE

Remedy

Upgrade to versions 17.7.6, 17.8.4, 17.9.1 or above.
First published (updated )

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203