A cross-site scripting vulnerability in GitLab CE and EE poses a significant risk of unauthorized script execution for authenticated users when specific CDN configurations are in place.

This is a stored cross-site scripting (CWE-79) flaw that allows an authenticated user to inject malicious scripts into web pages. The vulnerability is triggered when the GitLab instance is served through certain content delivery network configurations, which fail to properly neutralize user-supplied input.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of an authenticated user's session. With a CVSS score of 7.7, this represents a high-severity risk that could lead to session hijacking, unauthorized actions performed on behalf of legitimate users, or the exfiltration of sensitive information. The potential for reputational damage and unauthorized access to project data necessitates prompt remediation.

Immediate Action: Upgrade your GitLab CE/EE instances to versions 18.0.5, 18.1.3, 18.2.1, or higher to apply the security patch.

Proactive Monitoring: Review web access and application logs for suspicious patterns or anomalous script injections originating from authenticated user accounts.

Compensating Controls: Ensure that your Content Delivery Network (CDN) is configured to strictly enforce security headers and content security policies (CSP) to mitigate potential script execution if immediate patching is not feasible.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the linked HackerOne report.

Given the potential for unauthorized script execution, organizations should prioritize upgrading their GitLab environments to the specified patched versions. Failure to remediate this vulnerability leaves authenticated sessions susceptible to compromise, which could have cascading effects on internal development operations and data integrity. Apply the provided vendor updates immediately to secure your infrastructure.