GitLab Community and Enterprise Editions contain an improper input sanitization flaw that allows an authenticated user to inject arbitrary JavaScript into a web page rendered for another user. The vulnerability is identified as CWE-79. The CVE description does not specify the exact post‑exploitation outcomes, but it could potentially affect confidentiality, integrity, or availability of the victim’s browser session. The potential impact is explicitly that a malicious script can run in the context of another user’s session; further consequences such as data theft or credential compromise are inferred but are not directly stated in the CVE description.

The vulnerability applies to all GitLab CE/EE releases from 15.7 up to, but not including, 18.11.7; from 19.0 up to, but not including, 19.0.4; and from 19.1 up to, but not including, 19.1.2. Users running any of those unpatched versions are therefore at risk.

The CVSS score of 7.3 indicates a moderate to high severity, while the EPSS score < 1% suggests a low probability of exploitation. The issue is not listed in the CISA KEV catalog. Because the flaw requires an authenticated user, the attack vector is limited to privileged accounts in the GitLab instance, but successful exploitation can affect other users who view the compromised content. Official remediation is to upgrade to at least version 18.11.7, 19.0.4, or 19.1.2.