GitLab exhibits a cross‑site scripting flaw that allows an authenticated user to inject JavaScript into the web page of other users. The vulnerability arises when syntax‐highlighted output does not properly neutralize HTML attributes within a specially crafted repository, permitting the attacker to execute arbitrary scripts in the victim’s browser context. This can lead to theft of session cookies, defacement, or further lateral movement if other web resources are accessed.

The flaw affects GitLab Community Edition and Enterprise Edition, covering all releases starting from 19.1 up to, but not including, 19.2.8, 19.3.5, and 19.4.2. Users running any affected version of GitLab should identify whether they are on a vulnerable release and plan a migration to a fixed build.

The CVSS score of 8.7 classifies this as a high‑severity vulnerability. The EPSS score is unavailable, so the probability of exploitation in the wild cannot be quantified, but the absence of a KEV listing suggests no publicly known exploitation yet. The likely attack vector requires the attacker to already be authenticated within the GitLab instance; they create or modify a repository to include the malicious content, which then runs in others’ browsers when those users view the syntax‑highlighted code. Although no higher‑level privileges are needed, the impact on confidentiality and integrity of user sessions is substantial.