{"id":"CVE-2025-4439","title":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab","summary":"An issue has been discovered in GitLab CE/EE affecting all versions from 15.10 before 18.0.5, 18.1 before 18.1.3, and 18.2 before 18.2.1 that could have allowed an authenticated user to perform cross-site scripting attacks when the insta…","severity":"high","cvss":7.7,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N","cvssSource":"cna","cwe":["CWE-79"],"vendor":"GitLab","product":"GitLab","affected":["GitLab >= 15.10 < 18.0.5","GitLab >= 18.1 < 18.1.3","GitLab >= 18.2 < 18.2.1"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2025-07-25T03:55:24.387871Z"},"published":"2025-07-23","updated":"2026-11-03","sourceUpdated":"2026-11-03T22:03:04.008Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-4439","references":[{"url":"https://gitlab.com/gitlab-org/gitlab/-/issues/541177","label":"GitLab Issue #541177"},{"url":"https://hackerone.com/reports/3120111","label":"HackerOne Bug Bounty Report #3120111"}],"tags":["cve.org"],"epss":0.0028,"epssPercentile":0.2061,"ingestedAt":"2026-11-05T20:33:06.561Z","slug":"CVE-2025-4439","body":"## Overview\n\nAn issue has been discovered in GitLab CE/EE affecting all versions from 15.10 before 18.0.5, 18.1 before 18.1.3, and 18.2 before 18.2.1 that could have allowed an authenticated user to perform cross-site scripting attacks when the instance is served through certain content delivery networks.\n\n## Affected\n\n- `GitLab >= 15.10 < 18.0.5`\n- `GitLab >= 18.1 < 18.1.3`\n- `GitLab >= 18.2 < 18.2.1`\n\n## Remediation\n\nUpgrade to versions 18.0.5, 18.1.3, 18.2.1 or above.","depth":"twilight","depthScore":42,"depthScoreParts":{"impact":42.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}