GitLab has a flaw that improperly resolves path equivalence, allowing an unauthenticated user to trigger arbitrary JavaScript execution within a target user’s browser session. The vulnerability is rooted in CWE‑41, Path Manipulation, and could be used to hijack sessions, steal credentials, or inject malicious content while the victim is logged into GitLab.

The flaw impacts GitLab Community Edition and Enterprise Edition. All releases from 18.10.0 to 18.10.3 and the 18.11.0 release are affected. Versions 18.10.4, 18.11.1 and later contain the fix.

The CVSS score of 8 indicates a high severity level, though the EPSS score is not available, so the current exploit probability is unknown. Because the vulnerability is exploitable by unauthenticated users, an attacker can craft a request that bypasses path validation and deliver malicious JavaScript to any user who visits the targeted page. The vulnerability is not listed in CISA KEV and no public exploit has been reported at the time of this assessment. The likely attack vector is a crafted HTTP request that triggers the path conversion logic, and the impact is limited to the victims’ browser context but can be leveraged for social engineering or first‑party data theft.