GitLab Patches Multiple Vulnerabilities
GitLab has released critical security updates for its Community Edition (CE) and Enterprise Edition (EE) to address multiple high-severity vulnerabilities.
These patches, detailed in the release notes for versions 18.8.4, 18.7.4, and 18.6.6, resolve flaws that could allow attackers to steal access tokens, perform Denial of Service (DoS) attacks, or inject malicious scripts.
The most severe vulnerability patched in this release is CVE-2025-7659 (CVSS 8.0), an “Incomplete Validation” issue within the Web IDE.
This flaw could allow unauthenticated attackers to steal tokens and access private repositories, posing a significant risk to intellectual property and source code confidentiality.
Additionally, GitLab addressed two high-severity DoS vulnerabilities:
Other high-risk patches include fixes for Cross-Site Scripting (XSS) in Code Flow (CVE-2025-14560) and HTML Injection in test case titles (CVE-2026-0595), both of which could enable attackers to execute unauthorized actions or inject malicious content.
| CVE ID | Vulnerability | Product | CVSS Score |
|---|---|---|---|
| CVE-2025-7659 | Incomplete Validation in Web IDE | GitLab CE/EE | 8.0 |
| CVE-2025-8099 | DoS in GraphQL introspection | GitLab CE/EE | 7.5 |
| CVE-2026-0958 | DoS in JSON validation middleware | GitLab CE/EE | 7.5 |
| CVE-2025-14560 | XSS in Code Flow | GitLab CE/EE | 7.3 |
| CVE-2026-0595 | HTML Injection in test case titles | GitLab CE/EE | 7.3 |
| CVE-2026-1458 | DoS in Markdown processor | GitLab CE/EE | 6.5 |
| CVE-2026-1456 | DoS in Markdown Preview | GitLab CE/EE | 6.5 |
| CVE-2026-1387 | DoS in Dashboard | GitLab EE | 6.5 |
| CVE-2025-12575 | SSRF in Virtual Registry | GitLab EE | 5.4 |
| CVE-2026-1094 | Improper Validation in diff parser | GitLab CE/EE | 4.6 |
| CVE-2025-12073 | SSRF in Git repository import | GitLab CE/EE | 4.3 |
| CVE-2026-1080 | Authorization Bypass in iterations API | GitLab EE | 4.3 |
GitLab strongly recommends that all self-managed installations upgrade to version 18.8.4, 18.7.4, or 18.6.6 immediately to mitigate these risks.
GitLab.com has already been patched, and no action is required for GitLab Dedicated customers.
Administrators should prioritize these updates given the potential for data theft and service disruption.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…