CVE-2025-2255 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

Back Back to CVE browser

HIGH

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

Published Mar 27, 2025

8.7

HIGH

CVSS 3.1

EPSS 0.29%

Description

An issue has been discovered in Gitlab EE/CE for AppSec affecting all versions from 13.5.0 before 17.8.6, 17.9 before 17.9.3, and 17.10 before 17.10.1. Certain error messages could allow Cross-Site Scripting attacks (XSS). for AppSec.

Affected products

Vendor GitLab Product GitLab Default
unaffected
- Version
  13.5.0
  Status
  affected
  Constraints
  <17.8.6
- Version
  17.10
  Status
  affected
  Constraints
  <17.10.1
- Version
  17.9
  Status
  affected
  Constraints
  <17.9.3

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

GitLab

unaffected

Version	Status	Constraints
13.5.0	affected	<17.8.6
17.10	affected	<17.10.1
17.9	affected	<17.9.3

Remediation

Vendor solution

Upgrade to versions 17.8.6, 17.9.3, 17.10.1 or above.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (2)

https://gitlab.com/gitlab-org/gitlab/-/issues/524635
issue-trackingpermissions-requiredExploitIssue Tracking
https://hackerone.com/reports/2994150
technical-descriptionexploitpermissions-requiredPermissions Required

Link	Providers	Tags
https://gitlab.com/gitlab-org/gitlab/-/issues/524635		issue-trackingpermissions-requiredExploitIssue Tracking
https://hackerone.com/reports/2994150		technical-descriptionexploitpermissions-requiredPermissions Required