MEDIUM
CVE-2025-6186
CVSS
5.4
Description
An issue has been discovered in GitLab CE/EE affecting all versions from 18.1 before 18.1.4, and 18.2 before 18.2.2 that could have allowed authenticated users to achieve account takeover by injecting malicious HTML into work item names.
Summary dbcve.org
This is a stored XSS vulnerability in GitLab CE/EE where authenticated users can inject malicious HTML into work item names. The injected HTML can execute in the browsers of other users viewing these work items, potentially leading to session hijacking and account takeover.
Mitigation
Upgrade GitLab to version 18.1.4, 18.2.2, or later to patch the XSS vulnerability in work item name handling.
Weakness (CWE)
CWE-79
Cross-site Scripting (XSS)
EPSS Score
0.31%
Probability of exploitation in next 30 days
23.7th percentile
References
Base CVE data derived from NVD (public domain). Enrichment by
dbcve.org
(CC-BY-4.0). Fetched via API.