Loading vulnerability…
Reflected XSS in GitLab PlantUML Diagram Creation
A reflected cross-site scripting (XSS) vulnerability exists in GitLab CE/EE in all versions from 10.0 before 16.0.8, from 16.1 before 16.1.3, and from 16.2 before 16.2.2. The vulnerability is triggered when creating specific PlantUML diagrams, allowing an attacker to inject malicious scripts that are reflected and executed in the context of a victim's browser session.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of a victim's session, potentially leading to account compromise, data theft, or performing actions on behalf of the victim within GitLab.
If you can’t patch tonight, do this now.
As a temporary mitigation, restrict access to PlantUML diagram creation features, educate users to avoid clicking on untrusted links, and implement web application firewall (WAF) rules to detect and block reflected XSS payloads until the patch can be applied.
Patch, then assume compromise.
Upgrade GitLab CE/EE to version 16.0.8, 16.1.3, 16.2.2 or later, which contain the fix for this vulnerability.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.