Loading vulnerability…
Cross-Site Scripting in GitLab Merge-Request Error Messages
CVE-2025-2255 is a cross-site scripting vulnerability in GitLab Community Edition and Enterprise Edition merge-request error messages. Certain error-message content can permit XSS attacks in affected releases: versions 13.5.0 through before 17.8.6, 17.9.0 through before 17.9.3, and 17.10.0 through before 17.10.1.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits cross-site scripting attacks through merge-request error messages in the context in which the affected message is rendered.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure by limiting access to GitLab to trusted users, restricting who can create or manipulate content that may trigger merge-request error messages, and minimizing administrator use of potentially attacker-influenced merge-request workflows until the upgrade is completed. These measures are only temporary and do not replace patching.
Patch, then assume compromise.
Upgrade self-managed GitLab CE or EE installations to GitLab 17.8.6, 17.9.3, 17.10.1, or a later patched release.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.