GitLab disclosed an improper neutralization of input during web page generation that permits an authenticated user to embed malicious JavaScript. When another user views the affected content, the payload runs in their browser, potentially enabling the thief to steal session data, hijack the session, or perform unauthorized actions on the victim's behalf. The flaw is a classic XSS (CWE‑79) and could compromise the confidentiality, integrity, or availability of user data in the event a privileged user is targeted.

GitLab Community Edition and Enterprise Edition, versions starting from 18.11.0 up to but excluding 18.11.3 are affected. All releases prior to 18.11.3 contain the flaw and should be updated.

The CVSS score of 5.4 indicates moderate severity, but because the vulnerability enables arbitrary code execution in a victim’s browser, the practical impact is high if the attacker can authenticate and inject a payload. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, suggesting no known field‑of‑view exploitation at present. The likely attack path requires a legitimate, authenticated account to inject malicious content that is later rendered for another user, making the exploit contingent on user interaction and vulnerable input fields.