CVE-2025-12029 — Cross-site Scripting in Gitlab
Severity
8.0HIGHNVD
EPSS
0.2%
top 52.45%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedDec 11
Description
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.11 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have, under certain circumstances, allowed an unauthenticated user to perform unauthorized actions on behalf of another user by injecting malicious external scripts into the Swagger UI."
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:NExploitability: 1.6 | Impact: 5.8
Affected Packages5 packages
🔴Vulnerability Details
1GHSA▶
GHSA-2jwx-73fx-pwrv: GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15↗2025-12-11
📋Vendor Advisories
2GitLab▶
CVE-2025-12029: GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.11 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could↗2025-12-11
Debian▶
CVE-2025-12029: gitlab - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.11...↗2025