GitLab has identified a code injection vulnerability in its email notification system that allows an authenticated user to inject malicious HTML and JavaScript; the flaw arises from insufficient sanitization of user‑supplied input rendered in outgoing emails, enabling the attacker to deliver arbitrary JavaScript to recipients and potentially conduct phishing or cross‑site scripting attacks—CWE‑94.

The vulnerability affects GitLab Community Edition and Enterprise Edition instances. All versions from 15.11 up to but not including 18.9.7, from 18.10 up to but not including 18.10.6, and from 18.11 up to but not including 18.11.3 are impacted. The affected product is generally referred to as GitLab.

The CVSS score is 5.4, indicating a medium severity impact. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, so current exploit activity is unknown. The attack requires an authenticated user with permission to post content that will be included in email notifications. Once exploited, the attacker can compromise the confidentiality and integrity of the email content, potentially leading to phishing and credential theft. While the risk is moderate, the lack of public exploit evidence means the threat remains primarily theoretical at this time.