A critical cross-site scripting vulnerability in GitLab CE/EE allows unauthenticated attackers to execute arbitrary code in a victim's browser session.

This is a cross-site scripting (CWE-79) vulnerability occurring due to improper neutralization of input during web page generation. An unauthenticated attacker can trigger this flaw by convincing an authenticated user to visit a specially crafted webpage, resulting in code execution within the context of the user's browser session.

Successful exploitation allows an attacker to perform actions on behalf of the victim, potentially leading to unauthorized data access, account takeover, or the exfiltration of sensitive information. With a CVSS score of 8.0, this high-severity vulnerability poses a significant risk to the integrity and confidentiality of the GitLab environment, particularly for administrators or privileged users who may be targeted.

Immediate Action: Upgrade GitLab CE/EE instances to version 18.6.3, 18.7.1, or later to incorporate the vendor-provided security patches.

Proactive Monitoring: Monitor access logs and web traffic for suspicious patterns, particularly those originating from external sources targeting user-interactive endpoints.

Compensating Controls: Deploy a Web Application Firewall with strict XSS filtering rules to inspect and sanitize incoming web requests until the update can be applied.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the referenced HackerOne report.

Given the high CVSS score and the existence of a public proof-of-concept, this vulnerability should be treated as a high priority for internal security teams. Administrators must apply the patches for 18.6.3 or 18.7.1 immediately to prevent potential session hijacking and unauthorized code execution within their GitLab environments.