CVE-2025-9642 — Cross-site Scripting in Gitlab

CWE-79 — Cross-site Scripting4 documents4 sources
Severity
9.6CRITICALNVD
EPSS
0.0%
top 90.85%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
GitlabDebian GitlabGitlab CE
Timeline
PublishedSep 26

Description

An issue has been discovered in GitLab CE/EE affecting all versions from 14.10 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1 that could allow an attacker to inject malicious content that may lead to account takeover.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:HExploitability: 2.8 | Impact: 6.0

Affected Packages5 packages

▶CVEListV5gitlab/gitlab14.10 — 18.2.7+2
▶NVDgitlab/gitlab14.10.0 — 18.2.7+2
▶debiandebian/gitlab
▶gitlabgitlab/gitlab

🔴Vulnerability Details

1
GHSA
GHSA-2g5p-9p7q-76jj: An issue has been discovered in GitLab CE/EE affecting all versions from 14↗2025-09-26
▶

📋Vendor Advisories

2
GitLab
CVE-2025-9642: An issue has been discovered in GitLab CE/EE affecting all versions from 14.10 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1 that could al↗2025-09-26
▶
Debian
CVE-2025-9642: gitlab - An issue has been discovered in GitLab CE/EE affecting all versions from 14.10 b...↗2025
▶