This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.
[TLP:CLEAR] GitLab CE/EE fixes 9 vulnerabilities
With versions 18.5.2, 18.4.4 and 18.3.6, GitLab fixes 9 vulnerabilities in GitLab Community Edition (CE) and Enterprise Edition (EE) [1]. The most serious vulnerabilities are listed below.
An authenticated remote attacker can carry out a stored XSS attack in the Kubernetes proxy functionality [1].
The vulnerability is present in product:
- GitLab; >=15.10, <18.3.6; >=18.4, <18.4.4; >=18.5, <18.5.2;
CVSS: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
More information:
- CVE-2025-11224 at cve.org, NVD
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org
The vulnerability was publicly disclosed 12. 11. 2025.
An authenticated remote attacker can improperly remove other users' AI assistants from the GitLab Duo package [1].
The vulnerability is present in product:
- GitLab; >=18.1, <18.3.6; >=18.4, <18.4.4; >=18.5, <18.5.2;
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
More information:
- CVE-2025-11865 at cve.org, NVD
- CWE-863: Incorrect Authorization at cwe.mitre.org
The vulnerability was publicly disclosed 12. 11. 2025.
An authenticated remote attacker with a blocked account can access sensitive information through WebSocket connections within the GraphQL subscriptions functionality [1].
The vulnerability is present in product:
- GitLab; >=15.10, <18.3.6; >=18.4, <18.4.4; >=18.5, <18.5.2;
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
More information:
- CVE-2025-11865 at cve.org, NVD
- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor at cwe.mitre.org
The vulnerability was publicly disclosed 12. 11. 2025.
By CESNET, z.s.p.o. Martin Krajči on 13. 11. 2025.