Unrated severityNVD Advisory· Published Jun 12, 2025· Updated Jun 12, 2025
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in GitLab
CVE-2025-4278
Description
An issue has been discovered in GitLab CE/EE affecting all versions starting with 18.0 before 18.0.2. Under certain conditions html injection in new search page could lead to account takeover.
Affected products
3cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*range: 18.0
- (no CPE)range: >=18.0, <18.0.2
Patches
Vulnerability mechanics
References
2- hackerone.com/reports/3085738mitretechnical-descriptionexploitpermissions-required
- gitlab.com/gitlab-org/gitlab/-/issues/539198mitreissue-trackingpermissions-required
News mentions
1- GitLab Patch Release: 18.0.2, 17.11.4, 17.10.8GitLab Security Releases · Jun 11, 2025