by Kastro
Paper/Archive/CVE-2025-9642

CVE-2025-9642

GitLab GitLab — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

EPSS 0.6%CVSS 9.6
critical.is priorityof 100
38
CVSS 9.6 (NVD)9.6 / 10 × 3028.8Not in CISA KEV+300.0EPSS percentile 46.4.464 × 209.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

An issue has been discovered in GitLab CE/EE affecting all versions from 14.10 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1 that could allow an attacker to inject malicious content that may lead to account takeover.

Affected

ProductAffectedFixed inSource
GitLab14.10 – < 18.2.718.2.7CNA
GitLab18.3 – < 18.3.318.3.3CNA
GitLab18.4 – < 18.4.118.4.1CNA

Scores by source

NVD9.6CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
GitLab (CNA)8.7CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refgitlab.com/gitlab-org/gitlab/-/issues/566505exploithackerone.com/reports/3297413