This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.
[TLP:CLEAR] GitLab CE/EE fixes 7 vulnerabilities
GitLab fixes 7 vulnerabilities in GitLab Community Edition (CE) and Enterprise Edition (EE) in versions 18.7.1, 18.6.3 and 18.5.5 [1]. The most severe vulnerabilities are listed below.
An authenticated remote attacker can carry out a stored XSS attack in the Flavored Markdown environment [1].
The vulnerability is present in product:
- GitLab; >=18.2.2, <18.5.5; >=18.6, <18.6.3; >=18.7, <18.7.1;
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
More information:
- CVE-2025-9222 at cve.org, NVD
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org
The vulnerability was publicly disclosed 7. 1. 2026.
Using social engineering, an authenticated remote attacker can carry out an XSS attack in the Web IDE environment [1].
The vulnerability is present in product:
- GitLab; >=18.6, <18.6.3; >=18.7, <18.7.1;
CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
More information:
- CVE-2025-13761 at cve.org, NVD
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org
The vulnerability was publicly disclosed 7. 1. 2026.
An authenticated remote attacker can carry out a DoS attack by sending specially crafted responses to external API calls in the import functionality [1].
The vulnerability is present in product:
- GitLab; >=8.3, <18.5.5; >=18.6, <18.6.3; >=18.7, <18.7.1;
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
More information:
- CVE-2025-10569 at cve.org, NVD
- CWE-20: Improper Input Validation at cwe.mitre.org
The vulnerability was publicly disclosed 7. 1. 2026.
By CESNET, z.s.p.o. Martin Krajči on 8. 1. 2026.