What is the CVSS score of CVE-2025-2254?

CVE-2025-2254 has a CVSS 3.1 base score of 8.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of Gitlab are affected by CVE-2025-2254?

GitLab instances running versions 17.9 through 18.0.2 are vulnerable to cross-site scripting (XSS) attacks through the snippet viewer feature, potentially allowing attackers to steal user sessions,…. A patch is available.

How to fix or mitigate CVE-2025-2254?

Within 24 hours: Identify all GitLab instances in your environment and document their current versions. Within 7 days: Implement compensating controls (disable snippet viewer if possible, deploy WAF rules to block malicious snippet inputs, restrict snippet viewer access via network segmentation). Within 30 days: Prioritize upgrade to patched versions (17.10.8, 17.11.4, or 18.0.2+) as soon as patches become available, and conduct code review of any snippets accessed by users during the vulnerability window.

Gitlab CVE-2025-2254

EUVD-2025-18168 HIGH

Cross-site Scripting (XSS) (CWE-79)

2025-06-12 cve@gitlab.com

Gitlab XSS

8.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.7 HIGH

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Ubuntu

MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 14, 2026 - 21:20 euvd

EUVD-2025-18168

Analysis Generated

Mar 14, 2026 - 21:20 vuln.today

CVE Published

Jun 12, 2025 - 10:16 nvd

HIGH 8.7

DescriptionCVE.org

An issue has been discovered in GitLab CE/EE affecting all versions from 17.9 before 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2. Improper output encoding in the snipper viewer functionality lead to Cross-Site scripting attacks.

AnalysisAI

Cross-Site Scripting (XSS) vulnerability in GitLab's snippet viewer functionality caused by improper output encoding, affecting versions 17.9-17.10.7, 17.11-17.11.3, and 18.0-18.0.1. An authenticated attacker with UI interaction from a victim can execute arbitrary JavaScript in the context of the victim's browser session, potentially stealing session tokens, performing unauthorized actions, or stealing sensitive data. The CVSS score of 8.7 (High) reflects network accessibility and significant impact on confidentiality and integrity, though exploitation requires user interaction and authenticated access.

Technical ContextAI

The vulnerability resides in GitLab's snippet viewer component, which fails to properly encode user-controlled output before rendering it in HTML context. This is a classic CWE-79 (Improper Neutralization of Input During Web Page Generation) flaw where dynamic content from snippets is inserted into the DOM without sanitization or escaping. Snippets are code/text storage features in GitLab that support multiple syntax highlighting and display modes. The lack of output encoding allows malicious JavaScript payloads embedded in snippet content to execute with the privileges of the viewing user. The affected versions span GitLab Community Edition (CE) and Enterprise Edition (EE) across three major release branches, indicating this is a systemic issue in the rendering pipeline rather than isolated to a single component version.

RemediationAI

Immediate: Upgrade GitLab to patched versions—17.10.8 or later (17.10.x branch), 17.11.4 or later (17.11.x branch), or 18.0.2 or later (18.0.x branch). Interim mitigation (if immediate patching impossible): (1) Restrict snippet viewer access via role-based access control (RBAC) to trusted users only; (2) Disable snippet feature entirely if not required (Project Settings > Features > Snippets); (3) Monitor browser console/network logs for suspicious JavaScript execution; (4) Implement Content Security Policy (CSP) headers with script-src 'self' to restrict inline script execution (note: may break legitimate functionality); (5) Audit existing snippets for suspicious payloads. Reference vendor advisory from GitLab Security Releases page and apply patches during maintenance window. Test patches in staging environment before production deployment.