GitLab CE/EE CVE-2025-12734

Requires an authenticated GitLab user (PR:L) who can create or edit a merge request and place crafted HTML into the MR title field; the description notes it only works 'under certain conditions,' indicating specific rendering contexts (dialogs shown to other users) rather than universal triggering. Exploitation further requires a second user to interact with the UI that renders the title (UI:R), limiting it to a social-engineering / cross-user vector rather than silent exploitation. It affects GitLab CE/EE versions 15.6 through the patched releases (18.4.6, 18.5.4, 18.6.2); instances on these fixed versions are not exploitable. No elevation beyond a normal authenticated account is needed, but the requirement for both authentication and victim interaction, plus limited integrity-only impact, substantially constrains realistic risk.

This is a low-severity stored HTML injection (CWE-116) in GitLab CE/EE, and the signals are consistent in pointing to low real-world risk. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N, base 3.5) requires an authenticated attacker (PR:L) and victim interaction (UI:R), with only limited integrity impact (I:L) and no confidentiality or availability impact. The EPSS score of 0.27% (18th percentile) corroborates low expected exploitation likelihood. There is no CISA KEV listing, so this is not confirmed as actively exploited, and no public exploit code was identified - the referenced HackerOne report (3379381) is a coordinated disclosure, not published exploit tooling, so POC availability is unconfirmed. No SSVC decision data was provided. The signals do not conflict: a low CVSS, low EPSS, absence from KEV, and an authenticated+UI-gated attack all agree this is a hardening fix rather than an urgent priority. The main caveat is that the injection renders to OTHER users, which can carry cross-user/social-engineering risk beyond the raw I:L score, but it remains contingent on the malformed HTML sanitization context (no confirmed script execution / full XSS is described).

An authenticated GitLab user with permission to create or edit a merge request embeds malicious HTML into the MR title; when another user (e.g., a reviewer) opens a dialog that renders that title, the injected content is displayed in their session. No public exploit code was identified, and exploitation requires the victim to interact with the affected UI element.