GitLab CE/EE contains an improper input validation flaw that can trigger cross‑site scripting when a user visits the Storybook development interface. The flaw allows an unauthenticated attacker to inject code that runs in the victim’s browser, which can then read development‑environment tokens that should not be publicly exposed. The bug is identified as a CWE‑79 vulnerability and could lead to credential theft or other malicious actions executed in the context of the victim’s session.

All GitLab Community Edition and Enterprise Edition releases from 16.1.0 up to, but not including, 18.9.6, 18.10.4, and 18.11.1 are affected. No other versions were reported to be vulnerable.

The vulnerability has a CVSS score of 8, indicating high severity. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog. Because the exploit requires unauthenticated access to the Storybook interface, the attack vector is a remote, web‑based attack that can be performed by anyone with network visibility to the development environment. Successful exploitation could allow an attacker to read or exfiltrate tokens, compromising credential confidentiality and potentially enabling further lateral movement.