Loading vulnerability…
Cross-site scripting in GitLab Swagger UI
CVE-2025-12029 is a high-severity cross-site scripting vulnerability in GitLab Community Edition and Enterprise Edition affecting versions 15.11 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2. The flaw is in the Swagger UI and allows malicious external scripts to be injected into that interface under certain circumstances. If a victim user loads the affected Swagger UI content, the injected script can execute in the context of the victim’s GitLab session, enabling actions to be performed as that user. Available reporting describes the issue as exploitable by an unauthenticated attacker and classifies it as XSS with scope change and impacts to confidentiality and integrity.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can allow an attacker to execute script in a victim user’s browser within the GitLab application context and perform unauthorized actions on behalf of that user. The primary impact is compromise of confidentiality and integrity of the victim’s GitLab session and accessible resources, including the ability to act with the victim’s privileges inside the application. No direct availability impact has been described for this vulnerability.
If you can’t patch tonight, do this now.
Apply the vendor patch as the primary mitigation. If immediate upgrade is not possible, reduce exposure to the vulnerable Swagger UI, restrict access to GitLab interfaces that expose it, and limit opportunities for users to load untrusted or attacker-controlled Swagger-related content until the fixed version is deployed. GitLab.com was already patched at disclosure time.
Patch, then assume compromise.
Upgrade GitLab CE/EE to a fixed release. Patched versions are 18.4.6, 18.5.4, and 18.6.2 or later, depending on the deployed release train. Self-managed installations running affected versions should be updated immediately to a vendor-fixed version.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.