CVE-2025-6186 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

CVE-2025-6186

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab PUBLISHED

Description (CNA)

An issue has been discovered in GitLab CE/EE affecting all versions from 18.1 before 18.1.4, and 18.2 before 18.2.2 that could have allowed authenticated users to achieve account takeover by injecting malicious HTML into work item names.

Affected (CNA)

Vendor / product	Versions
GitLab / GitLab	affected 18.1 before 18.1.4; affected 18.2 before 18.2.2

CWE

CWE-79

References

https://gitlab.com/gitlab-org/gitlab/-/issues/549844
https://hackerone.com/reports/3189522

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.