EUVD-2025-18168
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Lifecycle Timeline
4Description
An issue has been discovered in GitLab CE/EE affecting all versions from 17.9 before 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2. Improper output encoding in the snipper viewer functionality lead to Cross-Site scripting attacks.
Analysis
Cross-Site Scripting (XSS) vulnerability in GitLab's snippet viewer functionality caused by improper output encoding, affecting versions 17.9-17.10.7, 17.11-17.11.3, and 18.0-18.0.1. An authenticated attacker with UI interaction from a victim can execute arbitrary JavaScript in the context of the victim's browser session, potentially stealing session tokens, performing unauthorized actions, or stealing sensitive data. The CVSS score of 8.7 (High) reflects network accessibility and significant impact on confidentiality and integrity, though exploitation requires user interaction and authenticated access.
Technical Context
The vulnerability resides in GitLab's snippet viewer component, which fails to properly encode user-controlled output before rendering it in HTML context. This is a classic CWE-79 (Improper Neutralization of Input During Web Page Generation) flaw where dynamic content from snippets is inserted into the DOM without sanitization or escaping. Snippets are code/text storage features in GitLab that support multiple syntax highlighting and display modes. The lack of output encoding allows malicious JavaScript payloads embedded in snippet content to execute with the privileges of the viewing user. The affected versions span GitLab Community Edition (CE) and Enterprise Edition (EE) across three major release branches, indicating this is a systemic issue in the rendering pipeline rather than isolated to a single component version.
Affected Products
GitLab CE/EE versions: 17.9.0 through 17.10.7 (patch: 17.10.8+); 17.11.0 through 17.11.3 (patch: 17.11.4+); 18.0.0 through 18.0.1 (patch: 18.0.2+). CPE string pattern: cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:* and cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:* for versions matching above ranges. Affected component: Snippet Viewer UI/rendering module. All deployment models impacted (self-hosted, SaaS).
Remediation
Immediate: Upgrade GitLab to patched versions—17.10.8 or later (17.10.x branch), 17.11.4 or later (17.11.x branch), or 18.0.2 or later (18.0.x branch). Interim mitigation (if immediate patching impossible): (1) Restrict snippet viewer access via role-based access control (RBAC) to trusted users only; (2) Disable snippet feature entirely if not required (Project Settings > Features > Snippets); (3) Monitor browser console/network logs for suspicious JavaScript execution; (4) Implement Content Security Policy (CSP) headers with `script-src 'self'` to restrict inline script execution (note: may break legitimate functionality); (5) Audit existing snippets for suspicious payloads. Reference vendor advisory from GitLab Security Releases page and apply patches during maintenance window. Test patches in staging environment before production deployment.
Priority Score
Vendor Status
Ubuntu
Priority: Medium| Release | Status | Version |
|---|---|---|
| xenial | ignored | - |
| jammy | DNE | - |
| noble | DNE | - |
| oracular | DNE | - |
| plucky | DNE | - |
| upstream | needs-triage | - |
Debian
| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| sid | fixed | 17.6.5-19 | - |
| (unstable) | not-affected | - | - |
Share
External POC / Exploit Code
Leaving vuln.today