GitLab CE/EE is vulnerable to a cross-site scripting attack that allows unauthenticated users to execute arbitrary JavaScript within a target user's browser session.

This vulnerability involves improper path validation (CWE-41), which allows an unauthenticated attacker to trigger arbitrary JavaScript execution in a user's browser. The flaw occurs due to logic errors in how the application resolves path equivalence, leading to potential cross-site scripting scenarios.

The ability for an unauthenticated attacker to execute arbitrary scripts in a user's browser session poses a significant risk to data integrity and session security. Successful exploitation could lead to session hijacking, unauthorized actions performed on behalf of legitimate users, or the exfiltration of sensitive information, justifying a high severity rating with a CVSS score of 8.0.

Immediate Action: Upgrade GitLab CE/EE installations to version 18.10.4, 18.11.1, or later to incorporate the necessary path validation fixes.

Proactive Monitoring: Review application access logs for suspicious URL patterns or unexpected JavaScript payloads originating from external, unauthenticated sources.

Compensating Controls: Deploy a Web Application Firewall (WAF) with robust cross-site scripting detection rules to filter malicious payloads targeting path-related endpoints.

Public Exploit Available: Yes — a published proof-of-concept exists, attributed to the security researcher's write-up on HackerOne (https://hackerone.com/reports/3572231).

Given the potential for unauthorized script execution and the existence of a public proof-of-concept, this vulnerability should be addressed as a priority. Administrators must apply the vendor-provided patches immediately to secure their GitLab environments against potential browser-based attacks.