External risk intelligence

GitLab Account Takeover Vulnerability via Content Injection.

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2025-9642

GitLab is commonly deployed as an internet-facing web application. As a collaborative platform, it is frequently exposed to the public internet to facilitate remote access for developers and automated systems, making its web interface a common edge service.

Cross-site Scripting

Gitlab

14.10.0 to before 18.2.718.3.0 to before 18.3.318.4.0

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

An identified vulnerability in GitLab could permit an attacker to inject malicious content, potentially leading to unauthorized account access. This issue affects specific versions of GitLab's community and enterprise editions.

Malicious content injection leading to account takeover.
Critical vulnerability impacting user access and data integrity.
Confirm relevance and exposure within our GitLab instances.

Attack Path

How an attacker could exploit the issue

An attacker could leverage a vulnerability in GitLab by first reaching the application over the network. After finding a way to inject malicious content, they could potentially take over user accounts.

Exposed to network, no privileges required.
Injecting malicious content.
Account takeover.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to inject malicious content into GitLab. When a user interacts with the injected content, it may lead to account takeover.

User accounts and sensitive data.
Through malicious content injection.
Unauthorized account access and control.

Operational Fix

Recommended remediation, mitigation, and detection steps

Responsible teams will likely include application owners, infrastructure, and security teams, given GitLab's typical deployment as an internet-facing web application. The initial step is to inventory all GitLab instances, determine their external reachability and business criticality, and identify the accountable owner to inform a risk-based remediation plan.

Application owners should manage the issue.
Verify external accessibility and business criticality.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is GitLab and what is it used for?

GitLab is a comprehensive software development platform that integrates version control, CI/CD pipelines, and project management tools. Organizations use it to host code repositories, automate software testing, and collaborate on development projects across distributed teams. Because it handles sensitive source code and infrastructure configurations, it serves as a central hub for engineering operations and deployment workflows.

What does CWE-79 mean in the context of CVE-2025-9642?

CWE-79 refers to Improper Neutralization of Input During Web Page Generation, commonly known as Cross-Site Scripting (XSS). In this vulnerability, GitLab fails to properly sanitize user-supplied data, allowing an attacker to inject malicious scripts into web pages. When other users view these pages, the script executes within their browser session, which can lead to the unauthorized account takeover described in this advisory.

How does an attacker trigger CVE-2025-9642?

An attacker triggers this vulnerability by injecting malicious content into a location within the GitLab application that gets rendered for other users. This does not require prior authentication or elevated privileges. However, the attack does not occur automatically; it relies on a user interacting with the injected content, such as navigating to a compromised page or viewing affected data, which then facilitates the malicious action.

Do I need to worry if my GitLab instance is internal?

According to Halo Surface Signal, you should still evaluate your risk. While GitLab is frequently deployed as an internet-facing edge service for remote developer access, instances restricted to internal networks remain potentially vulnerable if a malicious actor gains internal network access. You must assess the specific reachability and the security boundaries of your environment to determine the actual threat level to your organization.

When should I prioritize fixing this vulnerability?

You should begin by inventorying all GitLab instances to verify their current version against the affected releases. Once you confirm your versions are impacted, coordinate with your infrastructure and security teams to plan an update. Given the risk of account takeover and the critical severity of this issue, prioritize patching as part of your immediate risk-based remediation plan to protect user access and data integrity.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.