What is the CVSS score of CVE-2025-12669?

CVE-2025-12669 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2025-12669?

Yes, a patch is available for CVE-2025-12669. Update the affected software to the latest version immediately.

GitLab CE/EE CVE-2025-12669

EUVD-2025-209832 MEDIUM

Code Injection (CWE-94)

2026-05-14 cve@gitlab.com

GHSA-jfvv-q6f6-m4g5

Code Injection Gitlab RCE

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 11:24 vuln.today

Patch available

May 14, 2026 - 07:01 EUVD

DescriptionCVE.org

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.11 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user to inject HTML and JavaScript into email notifications sent to other users due to improper input sanitization.

AnalysisAI

HTML and JavaScript injection via email notifications in GitLab CE/EE (versions 15.11 through 18.11.2) allows an authenticated low-privileged user to deliver malicious content to other users' inboxes by embedding unsanitized markup into platform-generated notifications. The attack crosses a scope boundary (S:C in CVSS) because the injected code executes in the recipient's email client or browser context rather than GitLab itself, enabling phishing, credential harvesting, or session theft against targeted users. No public exploit has been identified at time of analysis and SSVC signals no active exploitation, though the broad version range - spanning over three years of releases - expands the exposed population significantly.

Technical ContextAI

The vulnerability stems from CWE-94 (Improper Control of Generation of Code), specifically a failure to sanitize user-supplied input before it is embedded into outbound email content generated by GitLab's notification system. GitLab CE and EE both generate automated email notifications for events such as issue comments, merge request updates, and mentions; user-controlled text fields that feed into these notifications are not properly stripped of HTML/JavaScript. The CVSS Scope:Changed attribute confirms that the injected payload escapes the GitLab application boundary and executes in the context of the recipient's mail client or webmail interface. Affected CPEs cover both community (cpe:2.3:a:gitlab:gitlab:*:*:*:*:community) and enterprise (cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise) editions. CWE-94 is broader than a pure XSS classification (CWE-79), suggesting the root cause may involve template rendering or dynamic content generation rather than a simple output-encoding gap.

RemediationAI

Upgrade to one of the following patched releases per the GitLab advisory at https://about.gitlab.com/releases/2026/05/13/patch-release-gitlab-18-11-3-released/: GitLab 18.11.3 or later, GitLab 18.10.6 or later, or GitLab 18.9.7 or later for the 18.9.x series. Organizations on older release trains (pre-18.9) should upgrade to the nearest fixed branch as GitLab does not back-port security fixes to end-of-life versions. If immediate patching is not feasible, a partial compensating control is to audit and restrict who can comment on issues, merge requests, or other notification-generating objects - limiting commit/comment access to trusted internal users reduces the attacker pool, though it does not eliminate the underlying flaw. Organizations using external email relay services should note that content-scanning or HTML-stripping at the mail gateway level may blunt payload delivery but is not a reliable substitute for patching, as encoding bypass techniques are well-documented.