CVE-2024-4835 is a high severity cross-site scripting flaw in GitLab Community and Enterprise Edition, scored 8.0 by NVD. It affects 15.11 before 16.10.6, 16.11 before 16.11.3 and 17.0 before 17.0.1. Upgrade to a patched release in your line.
What's affected
The NVD record lists three ranges for GitLab CE and EE:
- 15.11 up to but not including 16.10.6
- 16.11 up to but not including 16.11.3
- 17.0 up to but not including 17.0.1
The vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N. That reads as network reachable, high attack complexity, no privileges, user interaction required, and a changed scope. The scope change is why a cross-site scripting bug scores this high: script running in the victim's browser acts inside the GitLab origin.
Version caveat: the ranges above come from the NVD record. I did not retrieve GitLab's patch release notes for this CVE, so confirm the fixed versions against GitLab's published release post for your branch before you plan the change window.
The weakness class is CWE-79, improper neutralization of input during web page generation.
How to check if you're exposed
Self-managed instances show their version at the bottom of the Help page (/help) and in the Admin Area dashboard. From a shell on an omnibus install:
sudo gitlab-rake gitlab:env:info
Compare the reported version with the three ranges above. GitLab.com is operated by GitLab, so only self-managed installations need to act.
Do not stop at the GitLab instance. Other software can pin an old GitLab image in a compose file or Helm chart, so search your repositories for the image tag too.
What to do now
- Find every self-managed GitLab instance, including test and forgotten ones.
- Upgrade to 16.10.6, 16.11.3, 17.0.1 or later, following GitLab's upgrade path rules for your starting version.
- Review personal access tokens and recently created tokens for any you do not recognize, because the public issue discussion centers on token exposure.
- Tell users to treat unexpected links to your GitLab host with the usual caution until you have patched.
- Rescan any container images or deployment manifests that reference GitLab to make sure no stale copy remains.
Why it matters
The tracker issue linked from the CVE (GitLab issue 461328) describes the root cause in the Web IDE. The IDE loads an iframe that runs editor extensions and talks to its parent page with browser messages. According to the report, the receiving code did not properly validate the origin of those messages, and the iframe was served from the main GitLab origin instead of an isolated one. A hostile page could therefore drive it and run script as the signed-in user.
That is a one-click scenario: the victim has to open an attacker controlled page while signed in. The high complexity rating in the vector reflects that dependency. Source code hosts hold tokens, CI variables and write access to production code, so even a one-click flaw deserves a prompt patch.
NVD does not mark this CVE as exploited in the wild and it is not in the CISA KEV catalog.
Quick check
Does this affect GitLab.com?
GitLab operates GitLab.com and applies fixes itself. The upgrade work applies to self-managed instances.
Which weakness class is this?
Cross-site scripting, CWE-79. In this case the trigger is cross-origin messaging in the Web IDE, not a stored comment or form field.
Sources
- GitLab issue 461328
- NVD record for CVE-2024-4835 (affected ranges and score)
Last reviewed: 19 October 2026.
