GitLab patches XSS, privilege persistence, and command injection flaws
Patch & Detection Intelligence · 6 sources · Updated 4mo ago · First seen Oct 1, 2017
GitLab released security updates 17.10.1, 17.9.3, and 17.8.6 for Community Edition and Enterprise Edition to fix multiple vulnerabilities affecting self-managed deployments. The company said GitLab.com had already been patched and GitLab Dedicated customers did not need to take action, but urged self-managed administrators to upgrade immediately because the release addressed several high- and medium-severity issues across the platform.
The patched set includes two high-severity cross-site scripting flaws, a high-severity privilege persistence issue, and additional access control, resource consumption, and command injection weaknesses. GitLab linked the fixes to CVE-2025-2255, CVE-2025-0811, CVE-2025-2242, CVE-2024-12619, CVE-2024-10307, and CVE-2024-9773, and also disclosed a prompt injection issue in the Amazon Q integration that was still awaiting CVE assignment at the time of the release.
