Loading vulnerability…
Cross-site Scripting in GitLab CE/EE Code Flow
CVE-2025-14560 is a cross-site scripting vulnerability in the Code Flow functionality of GitLab Community Edition and Enterprise Edition. It affects all versions from 17.1 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4. Under certain conditions, an authenticated user can inject malicious content into the vulnerability code flow, which is then rendered in another user's browser. When the injected content is viewed, attacker-controlled script can execute in the victim's session context and be used to trigger actions as that user.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows an authenticated low-privilege attacker to perform unauthorized actions on behalf of another user within GitLab. Because the issue is an XSS flaw that executes in the victim's browser session, the attacker may be able to abuse the victim's authenticated context to access sensitive data exposed to that user, modify application state, or carry out workflow actions with the victim's privileges. The published CVSS information indicates confidentiality and integrity impact, with user interaction required.
If you can’t patch tonight, do this now.
No specific vendor workaround is available in the provided information. If immediate patching is not possible, reduce exposure by restricting access to affected GitLab instances to trusted users, limiting who can interact with the vulnerable Code Flow functionality, and increasing monitoring for suspicious content injection and anomalous actions performed through user sessions. These measures only reduce risk and do not eliminate the vulnerability.
Patch, then assume compromise.
Upgrade GitLab CE/EE to a fixed version. The issue is remediated in 18.6.6 and later for the 18.6 release line, 18.7.4 and later for the 18.7 release line, and 18.8.4 and later for the 18.8 release line. Self-managed deployments should prioritize upgrading to a supported patched release.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.