Loading vulnerability…
Cross-Site Scripting in GitLab CE/EE File Rendering
CVE-2025-0811 is a high-severity cross-site scripting vulnerability in GitLab Community Edition and Enterprise Edition caused by improper rendering of certain file types. It affects GitLab CE/EE versions 17.7 before 17.8.6, 17.9 before 17.9.3, and 17.10 before 17.10.1. The flaw allows attacker-controlled content embedded in certain rendered files to be interpreted by a victim’s browser as active script rather than inert content, resulting in client-side script execution in the context of the GitLab application.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can result in execution of arbitrary JavaScript in the browser context of a targeted GitLab user. This can enable session hijacking, unauthorized actions performed as the victim, access to data visible to the victim within GitLab, and potential abuse of the victim’s authenticated interaction with projects, repositories, merge requests, or other application features.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure by limiting access to untrusted users and untrusted content uploads or rendering workflows involving the affected file types. Restrict who can create or share content that will be rendered in the GitLab web interface, and apply compensating controls such as browser-side script restrictions where operationally feasible. These measures are temporary and do not replace upgrading to a fixed version.
Patch, then assume compromise.
Upgrade GitLab CE/EE to a fixed release. Patched versions are 17.8.6, 17.9.3, and 17.10.1 or later, depending on the deployed release track. Self-managed installations should be updated immediately to a patched version.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.