CVE-2024-1451 is a high severity (CVSS 8.7) stored cross-site scripting flaw in GitLab CE and EE. A crafted payload added to the user profile page could run in a victim's browser and act on their behalf. It affects versions from 16.9 before 16.9.1. Upgrade to 16.9.1 or later.
What's affected
The record says GitLab CE and EE are affected for all versions starting from 16.9 and before 16.9.1. That is a narrow window, because 16.9 had only just shipped when the fix arrived in 16.9.1.
If you run GitLab 16.8 or earlier you are outside the range named in the record, but you should still keep the instance current. The record references the GitLab issue tracker entry and a HackerOne report. I did not retrieve either page, so check the GitLab release post for 16.9.1 for any extra context.
How to check if you're exposed
Find the version in GitLab under Help, or the admin area, or on the server with:
sudo gitlab-rake gitlab:env:info
A version of exactly 16.9.0 is affected. For container deployments, read the image tag. If you manage many instances, build a list with their versions and compare it with 16.9.1.
To check a whole codebase at once, run the free in-browser dependency scan at gold.safeguard.sh/scan. You can also look up the CVE in the Gold directory, and use reachability analysis to see whether your code calls the affected path.
What to do now
- Check the GitLab version on every instance, including test and staging.
- Upgrade to 16.9.1 or a later release.
- Review user profile fields for content that looks like script, if you cannot upgrade immediately.
- Ask administrators to sign out of the admin area when browsing user profiles on an unpatched instance.
- Confirm your content security policy settings are in place.
Why it matters
The record classes this as CWE-79, cross-site scripting. Profile content was stored and later rendered without being fully neutralized, so the browser treated it as code when another user viewed the page.
Stored XSS is more serious than reflected XSS because the victim only has to look at a page. On a source code platform, actions taken on a victim's behalf can include changing settings or tokens. The score of 8.7 reflects the changed scope. The record's KEV flag is false.
Quick check
Which GitLab edition is affected?
Both Community and Enterprise Edition, according to the record.
What is the fixed version?
16.9.1 per the record. Confirm in the GitLab release notes.
Sources
- GitLab issue 441457 (listed in the NVD record, not retrieved)
- HackerOne report 2371126 (listed in the NVD record, not retrieved)
- NVD record data for CVE-2024-1451
Last reviewed: 19 October 2026.
