CVE-2025-9642 is a high severity (CVSS 8.7) cross-site scripting flaw in GitLab CE/EE that could lead to account takeover. It affects 14.10 before 18.2.7, 18.3 before 18.3.3 and 18.4 before 18.4.1. Upgrade to 18.2.7, 18.3.3 or 18.4.1, or later.
What's affected
GitLab CE and EE, all versions from 14.10 before 18.2.7, from 18.3 before 18.3.3, and from 18.4 before 18.4.1. The record and GitLab's patch release notice agree on these ranges. GitLab's notice says that when no deployment type is named, all types (Omnibus, source, Helm chart and others) are affected.
GitLab's notice titles the issue "Cross-site scripting issue in Script Gadgets" and says that, under certain conditions, it could have allowed an unauthenticated user to execute actions on behalf of other users by injecting malicious content. The record describes the outcome as account takeover. The public issue is titled HTML injection in code navigation leads to ATO.
The score and vector match between the record and GitLab's notice: 8.7 with CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N. There is a wording difference worth knowing about. The notice calls the attacker unauthenticated, while the vector requires low privileges and user interaction. Plan on the broader reading until you have patched, and read the notice for the exact conditions.
The class is CWE-79, cross-site scripting. GitLab thanks the reporter, joaxcar, who reported it through the GitLab HackerOne bug bounty program.
How to check if you're exposed
Self managed instances can read their version from the Help page in the web interface, or from the host. On an Omnibus install:
sudo gitlab-rake gitlab:env:info
Or query the package manager:
dpkg -l | grep gitlab
rpm -qa | grep gitlab
Compare the result to the fixed releases. 18.2.7, 18.3.3 and 18.4.1 are the patched versions for their branches. An instance on 18.2.6 or earlier within 14.10 to 18.2, on 18.3.2 or earlier, or on 18.4.0 is in scope.
GitLab.com is operated by GitLab, which handles its own deployment. If you use a hosted instance from another provider, ask them for their patch status.
What to do now
- Find your GitLab version and branch.
- Upgrade to 18.2.7, 18.3.3 or 18.4.1, or any later release on your branch.
- Follow GitLab's upgrade path guidance, and take a backup first.
- After patching, review recent account changes such as added email addresses, tokens and SSH keys on privileged users.
- If you cannot upgrade right away, limit who can reach the instance and who can push content to projects, and record the delay as a risk with an owner.
Why it matters
Cross-site scripting lets attacker controlled content run in a victim's browser session as if it came from the site. On a code hosting platform, a session that can change email addresses or tokens is a session that can take over an account. The vector rates confidentiality and integrity impact as high, which fits that.
The public issue describes this as a follow up to an earlier report. According to the reporter, a fix shipped in 18.2.2 for the earlier issue sanitised the data with a library but left a way through. That is the reporter's claim in the issue, not a statement from GitLab. The record does not mark this CVE as exploited in the wild, and it is not in the CISA Known Exploited Vulnerabilities catalog according to the record.
Try it yourself
This walkthrough shows how a finding like this is surfaced and triaged in a scan.
Click through it at your own pace, or open it full screen.
Quick check
Which GitLab versions fix CVE-2025-9642?
Versions 18.2.7, 18.3.3 and 18.4.1, for their respective branches, and later releases.
Does an attacker need an account?
GitLab's notice says an unauthenticated user could execute actions on behalf of other users, while the CVSS vector lists low privileges and user interaction. Patch first, then read the notice for the conditions.
Sources
- GitLab patch release 18.4.1, 18.3.3, 18.2.7
- GitLab issue 566505, HTML injection in code navigation
- Safeguard Gold entry: CVE-2025-9642
- CVE record fields as held in the Safeguard CVE record
Last reviewed: 18 October 2026.
