Loading vulnerability…
XSS in GitLab EE Maven Dependency Proxy
CVE-2025-0555 is a cross-site scripting vulnerability in the Maven Dependency Proxy component of GitLab Enterprise Edition. It affects GitLab EE versions from 16.6 before 17.7.6, 17.8 before 17.8.4, and 17.9 before 17.9.1. Under specific conditions, the flaw allows an attacker to bypass security controls and cause arbitrary script execution in a victim user's browser within the GitLab application context.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can result in arbitrary JavaScript execution in the browser of a targeted authenticated user interacting with the vulnerable GitLab EE functionality. This can enable theft of session data or other browser-accessible sensitive information, execution of actions as the victim within GitLab, interface manipulation, and compromise of data confidentiality and integrity within the victim's application context. The available scoring indicates no direct availability impact.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure to the vulnerable Maven Dependency Proxy functionality by restricting access to GitLab to trusted users and limiting use of the affected feature where operationally feasible. Because exploitation requires browser-side script execution in a user context, additional defensive measures such as minimizing untrusted content exposure and enforcing least-privilege access can reduce risk, but patching is the primary mitigation.
Patch, then assume compromise.
Upgrade GitLab Enterprise Edition to a fixed release. Patched versions include 17.7.6, 17.8.4, and 17.9.1 or later in the respective release trains. Self-managed installations should be updated to one of these patched versions or a newer supported release that includes the fix.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.