A critical cross-site scripting vulnerability in GitLab CE/EE allows authenticated attackers to perform unauthorized actions on behalf of other users, posing a significant risk to platform integrity.

This is a cross-site scripting (CWE-79) vulnerability where improper neutralization of user-supplied input allows an authenticated user to inject malicious content. The attack requires a low-privilege authenticated user to trigger the malicious script in the context of other users.

The ability for an attacker to execute actions as another user compromises the confidentiality and integrity of the entire GitLab environment. This could lead to unauthorized code changes, data exfiltration, or the escalation of privileges, potentially resulting in severe reputational damage and operational disruption. Given the CVSS score of 8.7, this vulnerability represents a high-risk security flaw that requires immediate attention.

Immediate Action: Upgrade GitLab installations to versions 18.0.6, 18.1.4, 18.2.2, or higher immediately to apply the vendor-supplied security patches.

Proactive Monitoring: Review audit logs for suspicious activity involving unexpected content modifications or anomalous user behavior within the GitLab interface.

Compensating Controls: Implement a robust Content Security Policy (CSP) and utilize a Web Application Firewall (WAF) to filter malicious input strings that may attempt to exploit cross-site scripting vectors.

Public Exploit Available: Yes — a published proof-of-concept exists as referenced in the HackerOne report 3247096.

The presence of a published proof-of-concept for this cross-site scripting vulnerability necessitates a rapid response. Security teams should prioritize patching all affected GitLab instances to the latest secure versions to prevent potential unauthorized account actions. Failure to remediate this flaw could expose the organization to significant risk of internal platform compromise.