An authenticated stored cross-site scripting vulnerability in GitLab CE/EE allows attackers to execute malicious scripts, posing a significant risk to user session integrity.

This is a stored cross-site scripting (XSS) vulnerability (CWE-79) triggered by improper neutralization of user-supplied input within GitLab Flavored Markdown. An authenticated user can inject malicious scripts that execute when viewed by other users.

Successful exploitation of this XSS flaw allows an attacker to execute arbitrary JavaScript in the victim's browser, potentially leading to unauthorized actions, session hijacking, or sensitive data theft. With a CVSS score of 8.7, this is a high-severity risk that could compromise the integrity of internal development workflows and administrative accounts within the GitLab instance.

Immediate Action: Update GitLab CE/EE instances to versions 18.5.5, 18.6.3, 18.7.1, or above to resolve the underlying input sanitization flaw.

Proactive Monitoring: Monitor audit and web access logs for unusual patterns, such as suspicious URLs or script tags embedded within Markdown content or issue comments.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated XSS filtering rules to detect and block malicious payloads submitted via the platform's Markdown rendering engine.

Public Exploit Available: Yes, a published proof-of-concept exists via the referenced HackerOne report.

Given the high CVSS score and the potential for session compromise, organizations should prioritize patching their GitLab environments. The ability for an authenticated user to perform stored XSS makes this a critical path for internal lateral movement or credential theft, necessitating an immediate upgrade to the specified patched versions.