CVE-2025-2254
Description
An issue has been discovered in GitLab CE/EE affecting all versions from 17.9 before 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2. Improper output encoding in the snipper viewer functionality lead to Cross-Site scripting attacks.
Summary dbcve.org
This is a stored Cross-Site Scripting (XSS) vulnerability in GitLab's snippet viewer functionality. The issue stems from improper output encoding, where malicious scripts embedded in snippets are not properly sanitized before rendering in the web interface. An attacker with low privileges (ability to create/modify snippets) can inject malicious JavaScript that executes when other users view the affected snippet.
Mitigation
Upgrade GitLab to version 17.10.8, 17.11.4, or 18.0.2 or later to receive the patch for this vulnerability.