Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
Vulnerability Description
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.11 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have, under certain circumstances, allowed an unauthenticated user to perform unauthorized actions on behalf of another user by injecting malicious external scripts into the Swagger UI."
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-12029
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Thanks [x0abcd_](https://hackerone.com/x0abcd_) for reporting this vulnerability through our HackerOne bug bounty program
References
More from GitLab
View All →Affected Vendor
GitLab
View all reports →