CVE-2025-13761highCWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8epss 0.6%

exploitation probability

0.6%top 54% of all CVEs

observed exploitation

nono source reports it

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed an unauthenticated user to execute arbitrary code in the context of an authenticated user's browser by convincing the legitimate user to visit a specially crafted webpage.

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N

Affected products

GitLab · GitLab

References

https://about.gitlab.com/releases/2026/01/07/patch-release-gitlab-18-7-1-released/https://access.redhat.com/security/cve/CVE-2025-13761 https://bugzilla.redhat.com/show_bug.cgi?id=2428218 https://gitlab.com/gitlab-org/gitlab/-/issues/582237 https://hackerone.com/reports/3441368 https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-13761.json