GitLab, the widely used DevSecOps platform, has released urgent security updates addressing multiple high-severity vulnerabilities that could allow attackers to take over user accounts, inject malicious code, and disrupt services.
The new versions—18.0.2, 17.11.4, and 17.10.8 for both Community Edition (CE) and Enterprise Edition (EE)—contain critical fixes, and administrators are strongly advised to upgrade immediately.
These updates are particularly important for organizations that manage their own GitLab instances.
GitLab.com, the hosted version, is already running the patched versions, and GitLab Dedicated customers do not need to take action.
However, self-managed installations must be upgraded to prevent exploitation of these vulnerabilities.
The following table summarizes the most critical vulnerabilities addressed in these releases:
| CVE ID | Vulnerability Type | Impacted Versions | Severity (CVSS) | Description |
|---|---|---|---|---|
| CVE-2025-4278 | HTML Injection | All versions from 18.0 before 18.0.2 | 8.7 | Allows account takeover via malicious code injection in the search page |
| CVE-2025-2254 | Cross-Site Scripting (XSS) | 17.9 before 17.10.8, 17.11 before 17.11.4, 18.0 before 18.0.2 | 8.7 | Allows malicious script execution in the snippet viewer, enabling session hijacking |
| CVE-2025-5121 | Missing Authorization | Ultimate EE: 17.11 before 17.11.4, 18.0 before 18.0.2 | 8.5 | Allows injection of malicious CI/CD jobs into all future pipelines of any project |
| CVE-2025-0673 | Denial of Service (DoS) | 17.7 before 17.10.8, 17.11 before 17.11.4, 18.0 before 18.0.2 | 7.5 | Infinite redirect loop causes memory exhaustion, denying access to legitimate users |
| CVE-2025-1516 | DoS via Webhook Token Names | 8.7 before 17.10.8, 17.11 before 17.11.4, 18.0 before 18.0.2 | 6.5 | Large webhook token names cause resource exhaustion |
| CVE-2025-1478 | DoS via Board Names | 8.13 before 17.10.7, 17.11 before 17.11.3, 18.0 before 18.0.1 | 6.5 | Large board names cause resource exhaustion |
| CVE-2024-9512 | Information Disclosure | Prior to 17.10.8, 17.11 before 17.11.4, 18.0 before 18.0.2 | 5.3 | Private repo clone possible when secondary node is out of sync |
| CVE-2025-5195 | Authorization Bypass | 17.9 before 17.10.7, 17.11 before 17.11.3, 18.0 before 18.0.1 | 4.3 | Access to arbitrary compliance frameworks beyond privileges |
| CVE-2025-5982 | IP Restriction Bypass | EE: 12.0 before 17.10.8, 17.11 before 17.11.4, 18.0 before 18.0.2 | 3.7 | Bypass group IP restrictions to view sensitive data |
The most severe vulnerability, CVE-2025-4278, allows attackers to inject malicious HTML into the GitLab search page.
Under certain conditions, this could lead to account takeover by executing arbitrary code in the context of a victim’s session.
This is especially dangerous because GitLab repositories often contain sensitive source code and configuration files, making them attractive targets for cybercriminals.
Another critical issue, CVE-2025-2254, is a cross-site scripting (XSS) vulnerability in the snippet viewer.
Attackers can inject malicious scripts that execute in the context of a legitimate user, potentially leading to session hijacking or data theft.
This vulnerability affects a wide range of GitLab versions and requires immediate patching.
For organizations using GitLab Ultimate EE, CVE-2025-5121 is particularly concerning.
An authenticated attacker can inject malicious CI/CD jobs into all future pipelines of any project. This could allow attackers to execute arbitrary code, steal sensitive data, or disrupt build and deployment processes.
The impact is limited to instances with a GitLab Ultimate license, but the potential for damage is significant.
Several Denial of Service (DoS) vulnerabilities—CVE-2025-0673, CVE-2025-1516, and CVE-2025-1478—could be exploited to exhaust server resources, causing service disruptions.
These vulnerabilities are particularly dangerous in high-availability environments where uptime is critical.
Other notable fixes include information disclosure vulnerabilities (CVE-2024-9512, CVE-2025-5195) and a group IP restriction bypass (CVE-2025-5982), which could allow unauthorized access to sensitive data.
Recommended Actions and Best Practices
GitLab strongly recommends that all affected installations be upgraded to the latest version as soon as possible.
The following technical steps are suggested:
GitLab’s DevSecOps platform is used by more than 30 million users and over half of the Fortune 100 companies.
Given its critical role in software development and deployment, prompt action is essential to protect sensitive data and maintain operational continuity.
By addressing these vulnerabilities, organizations can safeguard their development pipelines and prevent potentially catastrophic security incidents.
Find this News Interesting! Follow us on Google News, LinkedIn, & X to Get Instant Updates
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…