CRITICAL
CVE-2025-9642
CVSS
9.6
Description
An issue has been discovered in GitLab CE/EE affecting all versions from 14.10 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1 that could allow an attacker to inject malicious content that may lead to account takeover.
Summary dbcve.org
An injection vulnerability in GitLab CE/EE allows attackers to inject malicious content that can lead to account takeover. The flaw affects versions from 14.10 through the vulnerable ranges of 18.2, 18.3, and 18.4.
Mitigation
Upgrade GitLab to version 18.2.7 or later, 18.3.3 or later, or 18.4.1 or later to patch the injection vector and prevent account takeover.
Weakness (CWE)
CWE-79
Cross-site Scripting (XSS)
EPSS Score
0.54%
Probability of exploitation in next 30 days
44.5th percentile
References
Base CVE data derived from NVD (public domain). Enrichment by
dbcve.org
(CC-BY-4.0). Fetched via API.