CVE-2025-12734
📋 TL;DR
This vulnerability allows authenticated GitLab users to inject malicious HTML content into merge request titles, which could render in other users' dialogs under certain conditions. It affects GitLab CE/EE versions 15.6 through 18.6.1, potentially enabling cross-site scripting attacks.
💻 Affected Systems
- GitLab Community Edition
- GitLab Enterprise Edition
📦 What is this software?
Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →⚠️ Risk & Real-World Impact
Worst Case
An attacker could execute arbitrary JavaScript in victims' browsers, potentially stealing session cookies, performing actions as the victim, or redirecting to malicious sites.
Likely Case
Limited cross-site scripting affecting users who view merge requests with malicious titles, potentially leading to session hijacking or phishing.
If Mitigated
With proper content security policies and input validation, impact is limited to minor UI manipulation.
🎯 Exploit Status
Exploitation requires authenticated access and specific conditions for dialog rendering.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 18.4.6, 18.5.4, or 18.6.2
Vendor Advisory: https://about.gitlab.com/releases/2025/12/10/patch-release-gitlab-18-6-2-released/
Restart Required: Yes
Instructions:
1. Backup your GitLab instance. 2. Update to GitLab 18.4.6, 18.5.4, or 18.6.2 using your package manager. 3. Restart GitLab services. 4. Verify the update completed successfully.
🔧 Temporary Workarounds
Restrict Merge Request Creation
allTemporarily limit who can create or edit merge requests to trusted users only.
Enable Content Security Policy
allImplement strict CSP headers to mitigate XSS impact.
🧯 If You Can't Patch
- Implement web application firewall rules to block HTML injection patterns in merge request titles.
- Monitor merge request activity for suspicious title content and review user permissions.
🔍 How to Verify
Check if Vulnerable:
Check GitLab version via admin panel or command: sudo gitlab-rake gitlab:env:infoCheck Version:
sudo gitlab-rake gitlab:env:info | grep 'GitLab version'Verify Fix Applied:
Confirm version is 18.4.6, 18.5.4, or 18.6.2 or higher using same command.📡 Detection & Monitoring
Log Indicators:
- Unusual merge request title patterns containing HTML/script tags
- Multiple merge request edits by single user in short timeframe
Network Indicators:
- HTTP requests with suspicious payloads in merge request API endpoints
SIEM Query:
source="gitlab" AND (message="MergeRequest" OR message="merge_request") AND (message="<script>" OR message="javascript:")