CVE-2025-13761 is a high severity (8.0) cross site scripting issue in the Web IDE of GitLab CE and EE. It affects 18.6 before 18.6.3 and 18.7 before 18.7.1. Convincing a signed in user to visit a crafted page could run attacker code in their browser. Upgrade to 18.6.3, 18.7.1 or later.
What's affected
GitLab's patch release notes list the issue as Cross-site Scripting in Web IDE impacting GitLab CE and EE, rated High at CVSS 8.0.
- Affected: GitLab CE and EE from 18.6 before 18.6.3, and from 18.7 before 18.7.1.
- Fixed: 18.6.3 and 18.7.1.
The CVSS vector is AV:N/AC:H/PR:N/UI:R/S:C. A user has to visit a specially crafted page, and the effect crosses a security boundary, because the code runs in the context of an authenticated user's browser session.
How to check if you're exposed
Find your GitLab version.
sudo gitlab-rake gitlab:env:info
Or open the Help page in the web interface while signed in, or the admin area, and read the version. If it is 18.6.0 to 18.6.2 or 18.7.0, you are affected. Versions before 18.6 are not listed in the record.
GitLab.com is managed by GitLab. Self managed installations, including Docker images and Helm charts, need your own upgrade.
What to do now
- Check the version on every self managed GitLab instance.
- Upgrade to 18.6.3 or 18.7.1 or later, following the GitLab upgrade path for your current version.
- Remind users to avoid opening links from untrusted sources while signed in to GitLab.
- Review personal access tokens and project settings for recent changes you cannot explain.
- Subscribe to the GitLab security release notices so patch releases reach you quickly.
Why it matters
The weakness is CWE-79, cross site scripting. Input is handled as part of a page without being neutralized, so an attacker's script runs in the browser of a signed in user with that user's rights. In a source code platform those rights can include repositories, tokens and CI settings.
A Web IDE is a code editor in the browser and tends to work with powerful session privileges. That raises the value of an XSS in it. The user interaction requirement lowers the score, but links reach developers all the time, so treat patching as routine and soon.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which versions are fixed?
18.6.3 and 18.7.1 and later, according to GitLab's patch release notes.
Sources
Last reviewed: 19 October 2026.
