A high-severity output encoding vulnerability in GitLab CE/EE allows authenticated users to execute unauthorized actions on behalf of other users via HTML injection.

This vulnerability is caused by improper encoding or escaping of output (CWE-116), specifically within vulnerability code flow displays. An authenticated user with low privileges can inject malicious HTML to manipulate the application state for other users.

The ability for an attacker to perform actions on behalf of other users poses a significant threat to the integrity of the development environment. Successful exploitation could lead to unauthorized code changes, privilege escalation within the platform, or the compromise of sensitive vulnerability management data. With a CVSS score of 8.7, this flaw represents a high risk to organizational security and compliance.

Immediate Action: Upgrade all GitLab CE/EE installations to version 18.4.6, 18.5.4, 18.6.2, or later to incorporate the necessary output sanitization fixes.

Proactive Monitoring: Monitor GitLab application logs for suspicious activity involving vulnerability dashboard interactions or unexpected HTML content injection patterns.

Compensating Controls: Ensure that strict Content Security Policy (CSP) headers are implemented to mitigate the impact of potential HTML injection attacks while the patching process is underway.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the linked HackerOne report.

Given the potential for unauthorized user actions and the availability of technical details regarding the exploit, organizations should prioritize patching their GitLab environments. Apply the recommended versions immediately to eliminate the underlying vulnerability and prevent potential account compromise or unauthorized platform modifications.