Loading vulnerability…
HTML Injection Leading to XSS in GitLab Child Item Search
CVE-2024-8186 is an HTML injection vulnerability in the child item search feature of self-hosted GitLab Community Edition and Enterprise Edition. An attacker can inject HTML into the search feature, potentially resulting in cross-site scripting (XSS) under certain circumstances. Affected versions are GitLab CE/EE 16.6 through 17.7.5, 17.8 through 17.8.3, and 17.9 before 17.9.1.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits attacker-controlled HTML injection in the child item search. In certain situations, the injection can lead to cross-site scripting in the affected GitLab instance.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure by limiting access to the affected GitLab instance to trusted users, especially where lower-privileged authenticated users can interact with the child item search functionality. Monitor for suspicious content injection and review application-layer protections that reduce the likelihood of unsafe HTML rendering. Because the issue can lead to browser-side script execution, prioritizing upgrade is the most reliable mitigation.
Patch, then assume compromise.
Upgrade self-managed GitLab CE/EE installations to GitLab 17.7.6, 17.8.4, 17.9.1, or a later supported release. These releases mitigate CVE-2024-8186.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.