GitLab contains a cross‑site scripting flaw that lets an authenticated user inject malicious HTML into test case titles. The injected script can manipulate the victim’s account to add unauthorized email addresses, enabling an attacker to alter account settings or redirect communication. This vulnerability is classified as CWE‑79 and can lead to unauthorized account modification.

The defect affects GitLab Community Edition and Enterprise Edition in all releases from 13.9 through the last pre‑patch versions (13.9 ≤ v < 18.6.6, 18.7 < v < 18.7.4, 18.8 < v < 18.8.4). Users running these versions are susceptible.

The base CVSS score is 7.3, indicating a high severity, yet the EPSS score is less than 1 %, showing a low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. An attacker must be authenticated and have permission to create or edit test case titles; the attack is therefore limited to users with at least project maintainer or higher privileges. Once the script is executed in the victim’s browser, the attacker can add additional email addresses to the account.