Loading story…
GitLab released security updates for Community Edition (CE) and Enterprise Edition (EE), shipping patched versions 18.8.4, 18.7.4, and 18.6.6 for self-managed deployments (with GitLab.com already remediated). The most severe issue, CVE-2025-7659 (CVSS 8.0), was attributed to incomplete validation in the Web IDE that could allow an unauthenticated attacker to steal access tokens and use them to access private repositories.
The same release also addressed multiple high-severity availability and client-side issues, including CVE-2025-8099 (CVSS 7.5) enabling DoS via repeated/complex GraphQL queries and CVE-2026-0958 (CVSS 7.5) enabling resource exhaustion by bypassing JSON validation middleware limits. Additional fixes included CPU-exhaustion vectors involving specially crafted Markdown processing (e.g., CVE-2026-1456 and CVE-2026-1458) and an XSS issue in code flow functionality (CVE-2025-14560, CVSS 7.3) that could enable malicious script execution in a victim’s browser session.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
On 2026-02-13, Belgium's Centre for Cybersecurity published an advisory warning about multiple high-criticality vulnerabilities in GitLab CE/EE and calling for immediate patching. This reflects broader government amplification of GitLab's February 10 security release.
On 2026-02-11, the Canadian Centre for Cyber Security issued advisory AV26-114 referencing GitLab's February 10 security advisory. It urged users and administrators to review GitLab's guidance and apply patch versions 18.8.4, 18.7.4, and 18.6.6.
GitLab's advisory identified CVE-2025-7659 as the most severe issue, a Web IDE incomplete validation flaw that could let an unauthenticated attacker steal access tokens and access private repositories. The advisory also described additional DoS, XSS, HTML injection, and related vulnerabilities, and noted GitLab.com was already patched while some self-managed upgrades may involve database-migration downtime.
On 2026-02-10, GitLab published patch releases 18.8.4, 18.7.4, and 18.6.6 for Community Edition and Enterprise Edition, urging self-managed customers to upgrade immediately. The fixes addressed 13 vulnerabilities, including high-severity issues affecting the Web IDE, denial-of-service conditions, XSS, HTML injection, SSRF, and other validation and authorization flaws.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
ccb.belgium.be
Open sourcecyber.gc.ca
Open sourcecybersecuritynews.com
Open sourcesecurityonline.info
Open sourceabout.gitlab.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
GitLab released security updates `18.8.4`, `18.7.4`, and `18.6.6` for Community Edition and Enterprise Edition to fix multiple vulnerabilities affecting self-managed deployments, and urged customers to upgrade immediately. The most severe issue, **CVE-2025-7659** with CVSS `8.0`, is an incomplete validation flaw in the Web IDE that could allow an unauthenticated attacker to steal tokens and gain access to private repositories. GitLab.com had already been patched, and GitLab Dedicated customers were not required to take action. The release also addressed additional vulnerabilities tracked as **CVE-2025-8099**, **CVE-2026-0958**, **CVE-2026-0595**, and **CVE-2025-14560**, covering several denial-of-service conditions, cross-site scripting, HTML injection, server-side request forgery, and authorization bypasses across GitLab CE/EE and EE. GitLab said the patch release includes database migrations that may cause downtime on single-node deployments, while multi-node environments can avoid downtime by following zero-downtime upgrade procedures.
Jul 24, 2026
GitLab released security updates for **GitLab Community Edition (CE)** and **Enterprise Edition (EE)**, shipping patched versions **18.9.2**, **18.8.6**, and **18.7.6** to address multiple vulnerabilities affecting self-managed deployments. The Canadian Centre for Cyber Security issued advisory **AV26-222** urging organizations to review GitLab’s upstream advisory and apply the updates for any instances running versions prior to those releases. The update fixes **15 security issues**, including a high-severity **XSS** vulnerability (**CVE-2026-1090**, CVSS 8.7) in Markdown placeholder processing when the relevant feature flag is enabled, which could allow an authenticated attacker to inject malicious JavaScript into a victim’s browser. GitLab also addressed several **denial-of-service** conditions, including issues impacting the **GraphQL API** (resource exhaustion via recursion), repository archive endpoints, and JSON payload validation in the protected branches API; additional fixes include webhook-related DoS risks (e.g., **CVE-2025-13690**, **CVE-2025-12576**) and a **CRLF sequence** handling issue (**CVE-2026-3848**).
Jun 29, 2026
GitLab released security updates for Community Edition and Enterprise Edition, shipping versions **18.10.3**, **18.9.5**, and **18.8.9** to address multiple vulnerabilities tracked as `CVE-2026-5173`, `CVE-2026-1092`, `CVE-2025-12664`, and `CVE-2026-1101`. The patched issues include a high-severity flaw that could allow unintended server-side method invocation over WebSocket connections, along with several denial-of-service weaknesses affecting the Terraform state lock API and the GraphQL API. The release also fixes medium- and low-severity bugs including cross-site scripting in analytics dashboards, code-injection-related IP leakage in Code Quality reports, authorization weaknesses in APIs and custom roles, and information disclosure through GraphQL queries and CSV export. GitLab said **GitLab.com** had already been patched, **GitLab Dedicated** customers did not need to take action, and self-managed customers should upgrade immediately; the company added that the updates require no new migrations and should not cause downtime in multi-node deployments.
Jul 24, 2026