GitLab Enterprise Edition contains a cross‑site scripting (XSS) flaw that, when triggered by an authenticated user with developer permissions, can cause arbitrary client‑side code to run as another user. The vulnerability arises from improper sanitization of user‑supplied input, allowing injection of malicious scripts. This can be used to hijack sessions, deface pages, or exfiltrate data, representing a significant threat to confidentiality, integrity, and availability of the affected GitLab instance.

All GitLab EE versions from 16.4 up to, but not including, 18.11.6; from 19.0 up to, but not including, 19.0.3; and from 19.1 up to, but not including, 19.1.1 are affected. Users running these releases should confirm their exact version and apply the advisory recommendation.

The CVSS score of 8.7 indicates high severity, though EPSS data is currently unavailable, suggesting uncertainty about real‑world exploitation frequency. The vulnerability is not listed in the CISA KEV catalog, implying no confirmed public exploits, but the impact and high score warrant careful monitoring. Attackers would need to be authenticated as a team member with developer role, then embed malicious input into a web form or data field susceptible to XSS; achieving execution within the victim's session. The conditions make exploitation plausible on actively used projects.