A high-severity cross-site scripting vulnerability in GitLab CE/EE could allow an authenticated attacker to compromise user sessions and perform unauthorized actions.

This vulnerability is a stored cross-site scripting (XSS) flaw, identified as CWE-79, which occurs due to improper neutralization of input during web page generation. An attacker with low-level privileges can leverage this flaw to execute malicious scripts when a victim interacts with the affected component.

Successful exploitation allows an attacker to manipulate the user interface or steal sensitive information by executing scripts within the victim's browser session. Given the CVSS score of 8.7, this flaw poses a significant risk to organizational data integrity and session security. Unauthorized actions performed by an attacker could lead to account takeover or the exfiltration of private repository data.

Immediate Action: Upgrade all instances of GitLab CE/EE to version 19.0.6, 19.1.4, 19.2.2, or higher immediately.

Proactive Monitoring: Review application access logs for unusual patterns or suspicious script injections originating from authenticated user sessions.

Compensating Controls: Implement a strict Content Security Policy (CSP) to restrict the execution of unauthorized scripts within the browser environment.

Public Exploit Available: false

Organizations running the affected versions of GitLab should prioritize applying the provided security patches. Given the potential for session compromise, immediate remediation is required to maintain the security posture of the development environment.