8.7
High
CVE-2025-9222 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2.2 before 18.5.5, 18.6 before 18.6.3, and…
Description
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2.2 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed an authenticated user to achieve stored cross-site scripting by exploiting GitLab Flavored Markdown.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| GitLab 18.7 | 18.7 → < 18.7.1 | 18.7.1 |
| GitLab 18.6 | 18.6 → < 18.6.3 | 18.6.3 |
| GitLab 18.2 | 18.2.2 → < 18.5.5 | 18.5.5 |
| OpenShift Pipelines | Versions not published | |
| Red Hat OpenShift Container Platform 4 | Versions not published |
References
- GitLab Issue #562561 gitlab.com
- HackerOne Bug Bounty Report #3297483 hackerone.com
- about.gitlab.com about.gitlab.com
Timeline
- Published
- Last modified
Other CVEs of GitLab
The 1114 CVEs of GitLab →
CVE-2026-110264
An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10,…
10.0
Critical
CVE-2026-12664
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.3.6, 19.4 before 19.4.3, and…
6.8
Medium
CVE-2026-13319
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.10 before 19.3.6, 19.4 before 19.4.3,…
4.3
Medium
CVE-2026-14288
GitLab has remediated an issue in GitLab EE affecting all versions from 17.4 before 19.3.6, 19.4 before 19.4.3, and 19.5…
3.1
Low