CVE-2025-6186CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

High · published August 13, 2025

CVSS v3.1
8.7
EPSS
0%
Percentile
23.5
In the wild
Unconfirmed
What it is

An issue has been discovered in GitLab CE/EE affecting all versions from 18.1 before 18.1.4, and 18.2 before 18.2.2 that could have allowed authenticated users to achieve account takeover by injecting malicious HTML into work item names.

The record
Technical detail
CVSS v3.1
8.7 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00318 · 23.5th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-08-13T17:26Z
EPSS history
Timeline
  • 13 AUG 17:26Z
    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
    cvelistv5