GitLab contains a stored cross‑site scripting flaw whereby a specially crafted URL can cause arbitrary JavaScript to run in a victim’s browser. The vulnerability stems from insufficient sanitization of user‑controlled input and is categorized as CWE‑79. An attacker who can send a user such a URL would be able to execute code with the victim’s privileges, potentially leading to session hijacking, credential theft, or other downstream attacks. The impact is limited to the context of the web application and does not grant direct system access.

The flaw is present in GitLab Community and Enterprise Editions from version 14.0 up through 19.0.4, all 19.1 releases before 19.1.3, and 19.2 releases before 19.2.1. Vendors affected are GitLab:GitLab. The recommended remedy is to upgrade to GitLab 19.0.5, 19.1.3, 19.2.1, or any newer release.

The CVSS score of 4.7 indicates a moderate overall risk. The EPSS score is below 1%, implying that, according to current data, the probability of exploitation is low but not zero. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires a user to visit a crafted URL; thus the attack vector is primarily user interaction via a web browser. Because the vulnerability was present only in a specific range of versions and under certain request conditions, the likelihood of successful exploitation is limited unless these conditions are met by the attacker. Nonetheless, the presence of an XSS vector warrants timely remediation.