BIT-gitlab-2025-9642

vendorUSosv

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

view advisory published 2025-10-01Licence: per source

An issue has been discovered in GitLab CE/EE affecting all versions from 14.10 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1 that could allow an attacker to inject malicious content that may lead to account takeover.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2025-9642US	critical9.6	0.56% (46th)	—	2025-09-26
An issue has been discovered in GitLab CE/EE affecting all versions from 14.10 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1 that could allow an attacker to inject mali…

references

External citations — patches, advisories, analysis.

https://gitlab.com/gitlab-org/gitlab/-/issues/566505WEB
https://hackerone.com/reports/3297413WEB
https://nvd.nist.gov/vuln/detail/CVE-2025-9642WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan