CVE-2025-9222
HighCVSS 8.7Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
A vulnerability in GitLab CE/EE allows an authenticated user to perform a Stored Cross-Site Scripting (XSS) attack by exploiting GitLab Flavored Markdown. The issue affects versions from 18.2.2 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1.
Risk Assessment
An attacker can inject a malicious script that executes in other users' browsers, potentially leading to session theft, data leakage, or unauthorized actions in the victim's context.
Recommendation
Immediately upgrade GitLab to version 18.5.5, 18.6.3, or 18.7.1 depending on the release line in use.
Other vulnerabilities in GitLab
See all- CVE-2026-0723High
GitLab CE/EE versions from 18.6 before 18.6.4, 18.7 before 18.7.2, and 18.8 before 18.8.2 contain a vulnerability that could allow an individual with knowledge of a victim's credential ID to bypass two-factor authentication by submitting forged device responses.
- CVE-2025-13928High
GitLab CE/EE versions from 17.7 before 18.6.4, 18.7 before 18.7.2, and 18.8 before 18.8.2 contain a vulnerability that could allow an unauthenticated user to cause a denial of service condition by exploiting incorrect authorization validation in API endpoints.
- CVE-2025-13927High
GitLab CE/EE versions from 11.9 before 18.6.4, 18.7 before 18.7.2, and 18.8 before 18.8.2 contain a vulnerability that could allow an unauthenticated user to create a denial of service condition by sending crafted requests with malformed authentication data.
- CVE-2025-11224High
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.10 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2 that could have allowed an authenticated user to execute stored cross-site scripting through improper input validation in the Kubernetes proxy functionality.
- CVE-2016-9469High
Multiple versions of GitLab expose a dangerous method that could lead to the deletion of all Issue and MergeRequest objects by any authenticated user. For publicly available projects, this vulnerability could be exploited by unauthenticated users.
- CVE-2016-4340High
The impersonate feature in Gitlab versions 8.7.0, 8.6.0 through 8.6.7, 8.5.0 through 8.5.11, 8.4.0 through 8.4.9, 8.3.0 through 8.3.8, and 8.2.0 through 8.2.4 allows remote authenticated users to 'log in' as any other user via unspecified vectors.
- CVE-2026-19478Critical
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could allow an unauthenticated user to remotely modify or delete public projects and user data via a GraphQL directive.
- CVE-2021-22205CriticalActively exploited
A vulnerability in GitLab CE/EE from version 11.9 allows remote code execution due to improper validation of image files passed to a parser.
- CVE-2026-77801Medium
GitLab CE/EE versions from 12.8 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 contain a vulnerability that, under certain conditions, could allow an authenticated user to cause a denial of service affecting background job processing due to missing object count limits.
- CVE-2026-3035Medium
GitLab EE versions from 11.3 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 contain a vulnerability that, under certain conditions, could allow an authenticated user with project Maintainer permissions to access the terminal of a protected environment they were not authorized to use due to improper authorization checks.
Original NVD description (English source)
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2.2 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed an authenticated user to achieve stored cross-site scripting by exploiting GitLab Flavored Markdown.