Loading vulnerability…
Improper encoding / HTML injection in GitLab vulnerability code flow displays
CVE-2025-8405 is a high-severity improper encoding vulnerability in GitLab Community Edition and Enterprise Edition. Affected versions fail to safely encode untrusted content rendered in vulnerability report code flow displays, allowing malicious HTML injection. An authenticated attacker can place crafted HTML into content that is later displayed to another user in the vulnerability reporting interface, which can execute in that user’s browser context and enable actions to be performed on the victim’s behalf. Affected versions are GitLab CE/EE 17.1 through before 18.4.6, 18.5.x before 18.5.4, and 18.6.x before 18.6.2.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can compromise the integrity of user actions within GitLab by causing a victim user’s browser to execute attacker-controlled HTML/script content in the context of the application. This can allow unauthorized actions to be performed as the victim user and may also expose sensitive data available to that user in the affected interface context. The issue is high severity and primarily affects confidentiality and integrity rather than availability.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure to the vulnerable rendering path by restricting access to vulnerability report features and limiting which authenticated users can create or modify content that is rendered in vulnerability code flow displays. Increase scrutiny of user-supplied content shown in security reporting workflows and monitor for suspicious HTML injection attempts. These are temporary risk-reduction measures only; vendor-fixed versions should be applied as soon as possible.
Patch, then assume compromise.
Upgrade GitLab Community Edition or Enterprise Edition to a fixed release. The vulnerability is remediated in versions 18.4.6, 18.5.4, and 18.6.2 and later. Self-managed deployments running affected versions should apply the vendor patch on the appropriate supported upgrade path. Because the release includes database migrations, upgrade planning should account for potential downtime on single-node deployments.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.