Loading vulnerability…
XSS in GitLab CE/EE Kubernetes proxy endpoint
CVE-2025-0475 is a high-severity cross-site scripting vulnerability in GitLab Community Edition and Enterprise Edition affecting all versions from 15.10 before 17.7.6, 17.8 before 17.8.4, and 17.9 before 17.9.1. The flaw is in a Kubernetes proxy endpoint, where a proxy feature can allow unintended content rendering under specific circumstances. This rendering behavior can cause attacker-controlled content to be interpreted in a victim’s browser, resulting in cross-site scripting.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can cause arbitrary script execution in the context of a victim user’s browser session within GitLab. Depending on the victim’s privileges, this can enable theft of session data, execution of actions as the victim, access to sensitive data exposed through the web application, and compromise of integrity within the affected GitLab instance. The published CVSS vector indicates scope change and high confidentiality and integrity impact, with no direct availability impact.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure to the vulnerable Kubernetes proxy functionality where operationally feasible, restrict access to GitLab to trusted users, and minimize opportunities for lower-privileged users to supply content that could be rendered through the affected proxy path. Standard browser-side controls such as CSP may reduce exploit reliability in some deployments, but they are not a substitute for upgrading.
Patch, then assume compromise.
Upgrade GitLab CE/EE to a fixed release: 17.7.6, 17.8.4, 17.9.1, or a later patched version. Self-managed installations should be updated immediately to a release that includes the fix. GitLab.com was already running a patched version at the time of disclosure.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.