GitLab Enterprise Edition reports for code quality could include malicious content that causes the system to transparently share the IP addresses of users who view those reports. The defect is a flaw in how the software generates report code, allowing an attacker with legitimate access to inject code designed to expose client network details. Because the exposed information is not otherwise protected, an attacker can learn the geographic location or network topology of users, which may facilitate future targeting or privacy violations.

All GitLab Enterprise Edition releases before version 18.8.9, before 18.9.5, and before 18.10.3 are affected. The issue applies to the standard GitLab EE code base and would be present in any installation of those milestone releases that has enabled the code quality report feature.

The vulnerability is assigned a CVSS score of 5.7, indicating medium severity. No EPSS score is available, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires an authenticated user at least able to submit or edit code quality reports, so it is most relevant to insiders or compromised accounts. While no public exploit has been disclosed, the potential for IP leakage and the ease of creating a malicious report make the threat real. The vendor’s patch removes the code injection vector, eliminating the risk from properly updated systems.