An authenticated user can embed malicious content into a Code Quality report in GitLab Enterprise Edition. When another authenticated user opens that report, the embedded code leaks the viewer’s IP address to the attacker. The flaw is a form of code injection (CWE‑94) that results in disclosure of sensitive network information, but it does not provide remote code execution.

All GitLab EE releases from 18.0.0 up to, but not including, 18.8.9, 18.9.5, and 18.10.3 are affected. The vulnerability manifests whenever Code Quality reports are enabled and a user has permission to view reports. The issue is platform‑agnostic and affects every environment running the affected GitLab versions.

The CVSS base score of 5.7 indicates moderate severity, while the EPSS score of less than 1 % suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an attacker to be authenticated to GitLab, craft a malicious report, and persuade or force another authenticated user to view the report. The potential impact is limited to IP‑address leakage, but the privacy breach could be a precursor to more targeted attacks.