A high severity cross-site scripting vulnerability in GitLab allows an authenticated attacker to impersonate other users via malicious wiki content.

This flaw is a cross-site scripting (CWE-79) vulnerability occurring within the wiki page creation functionality. An authenticated user can inject malicious content into wiki pages, which triggers unauthorized actions when viewed by other users, including those with higher privileges.

The exploitation of this vulnerability poses a significant risk to organizational integrity and data security. By impersonating other users, an attacker could gain unauthorized access to sensitive repositories, modify project configurations, or escalate privileges within the GitLab environment. Given the CVSS score of 8.7, this vulnerability represents a high risk that could lead to widespread account compromise if left unpatched.

Immediate Action: Upgrade all GitLab CE/EE instances to version 18.4.6, 18.5.4, 18.6.2, or higher immediately.

Proactive Monitoring: Monitor application access logs for unusual wiki activity or unauthorized modifications to sensitive project files.

Compensating Controls: Implement a Content Security Policy (CSP) to restrict the execution of unauthorized scripts and utilize a Web Application Firewall (WAF) to detect and block common cross-site scripting payloads.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the HackerOne report linked in the vulnerability references.

This vulnerability presents a clear path for account impersonation and unauthorized system interaction. Organizations should prioritize the deployment of the vendor-supplied patches to all affected GitLab instances to prevent potential lateral movement or data exfiltration. Given the availability of technical details regarding the exploit, delaying remediation increases the risk of successful targeting.