GitLab has a vulnerability that allows an unauthenticated user to inject and execute arbitrary JavaScript within a victim’s browser session. The flaw stems from improper path validation during web page generation, leading to uncontrolled content rendering. At its core, this is a classic CWE‑79 input validation flaw that can enable attackers to hijack sessions, steal credentials, or perform other malicious actions within the victim’s browser context. The impact is non‑destructive to the GitLab server itself but can compromise the confidentiality and integrity of users who view the affected pages.

The issue affects GitLab Community and Enterprise Editions from version 18.10 up to but not including 18.11.6, from 19.0 up to but not including 19.0.3, and from 19.1 up to but not including 19.1.1. All earlier or fixed releases are not impacted.

With a CVSS score of 8 the vulnerability is considered high severity. Its exploitation does not require authentication, so any user who can visit a crafted URL may trigger it. EPSS information is not available, but the lack of a KEV listing suggests no publicly known exploits yet. Nevertheless, the potential for widespread attacks in exposed installations warrants prompt action.