Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.7
CVE-2025-4278: GitLab search page allows HTML injection leading to account takeover
CVE-2025-4278 · published 1 year ago
Summary
GitLab Community and Enterprise editions from version 18.0 up to but not including 18.0.2 let a specially crafted search request insert HTML code into the page. This can let an attacker steal a user's login credentials and take over their account. Update GitLab to version 18.0.2 or later, or apply the provided patch, to stop the issue.
What to do
- Update gitlab gitlab to version 18.0.2 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| gitlab | gitlab |
>= 18.0.0, < 18.0.2 cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:* |
Original advisory text
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions starting with 18.0 before 18.0.2. Under certain conditions html injection in new search page could lead to account takeover.
References
- https://gitlab.com/gitlab-org/gitlab/-/issues/539198 Third Party Advisory
- https://hackerone.com/reports/3085738 Third Party Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/4xxx/CVE-2025-4278.j... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-4278 Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-80Basic XSS
Timeline
Published12 Jun 2025
Updated20 Oct 2026
First seen7 Mar 2026
Track software like this
Free during beta