GitLab Enterprise Edition contains a cross‑site scripting vulnerability that allows an authenticated user with developer‑role permissions to inject and execute arbitrary JavaScript in other users’ browsers. The flaw stems from improper neutralization of user input when generating web pages. A successful exploitation would compromise the confidentiality and integrity of a victim’s session, potentially permitting credential theft, session hijacking, or malicious navigation. This weakness is identified as CWE‑79 and is rated high severity (CVSS 8.7).

The issue affects all GitLab Enterprise Edition releases from 16.4 up to 18.9.6, 18.10.5, and 18.11.2. Users running any of these versions are at risk and should consider upgrading immediately.

The vulnerability is exploitable only by authenticated developers; thus the attack requires valid credentials but can be abused to compromise other users through the web interface. No public exploit is currently documented, and the EPSS score is not available, though the high CVSS indicates significant potential damage. The CVE is not listed in CISA KEV, but the lack of a public exploit does not mitigate the risk of an attacker creating a custom payload. The likely attack vector is a web‑based code injection through a form or URL parameter that is rendered without proper escaping.