Loading vulnerability…
Stored XSS in GitLab Wiki
CVE-2025-12716 is a high-severity cross-site scripting vulnerability in GitLab Community Edition and Enterprise Edition Wiki functionality. In affected versions, an authenticated user can create wiki pages containing malicious content that is later rendered in another user's browser, enabling script execution in the context of the GitLab application. The issue is consistent with improper neutralization of untrusted input during web page generation and can lead to unauthorized actions being performed as the victim user when the malicious wiki content is viewed. Affected versions are GitLab CE/EE 18.4 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can allow an attacker to execute script in a victim user's authenticated browser session within GitLab. This can result in session hijacking, access to sensitive data available to the victim, and unauthorized actions performed on behalf of the victim user. Based on the published severity and CVSS vector, the primary impacts are to confidentiality and integrity rather than availability.
If you can’t patch tonight, do this now.
Apply the vendor patch as the primary mitigation. Until upgrades are completed, reduce exposure by restricting who can create or edit wiki content, closely monitoring wiki changes for malicious content, and limiting access to affected instances where feasible. Because exploitation requires rendering malicious wiki content in a victim browser, organizations should also warn users not to open untrusted wiki pages until remediation is complete.
Patch, then assume compromise.
Upgrade GitLab Community Edition or Enterprise Edition to a fixed release. The issue is remediated in versions 18.4.6, 18.5.4, and 18.6.2. Self-managed deployments running affected versions should update to the appropriate patched version or later following vendor upgrade guidance.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.