A critical cross-site scripting vulnerability in GitLab CE/EE permits unauthenticated attackers to execute arbitrary scripts within the Mermaid sandbox UI, posing a significant risk to user session security.

This is a stored cross-site scripting (CWE-79) flaw located within the Mermaid sandbox UI, which allows an unauthenticated attacker to inject malicious scripts that execute in the context of a victim's session.

The ability for an unauthenticated user to inject arbitrary scripts into the GitLab interface presents a severe risk to organizational security. Successful exploitation could lead to account takeover, the theft of sensitive session tokens, or unauthorized actions performed on behalf of authenticated users, undermining the integrity of the development environment. With a CVSS score of 8.0, this high-severity vulnerability requires immediate attention to prevent potential data compromise and lateral movement within the CI/CD pipeline.

Immediate Action: Upgrade all instances of GitLab CE/EE to version 18.7.5, 18.8.5, 18.9.1, or above to resolve the underlying input neutralization flaw.

Proactive Monitoring: Review application access logs for unusual patterns or attempts to access the Mermaid rendering engine, particularly from unauthenticated or suspicious external sources.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block malicious script injection attempts, providing a temporary layer of defense while the update is staged.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the referenced HackerOne report.

Given the potential for unauthorized script execution and the existence of a documented proof-of-concept, organizations must prioritize the application of the vendor-provided security updates. Administrators should verify their current GitLab version and apply the recommended patches immediately to mitigate the risk of cross-site scripting attacks against their development infrastructure.