CVE-2025-4278CWE-80

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in GitLab

High · published June 12, 2025

CVSS v3.1
8.7
EPSS
11%
Percentile
95.9
In the wild
Unconfirmed
What it is

An issue has been discovered in GitLab CE/EE affecting all versions starting with 18.0 before 18.0.2. Under certain conditions html injection in new search page could lead to account takeover.

The record
Technical detail
CVSS v3.1
8.7 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.10883 · 95.9th percentile
Weakness
CWE-80 · Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Published
2025-06-12T10:02Z
EPSS history
Timeline
  • 12 JUN 10:02Z
    Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in GitLab
    cvelistv5