Executive brief
GitLab, a platform used by developers to manage and store software code, has fixed a security flaw that could allow a logged-in user to send malicious emails to other users. By including hidden code in certain fields, an attacker could cause a victim's email client to display unauthorized content or run malicious scripts when the notification email is opened. This could be used to mislead employees or potentially steal sensitive information through phishing-style attacks.
Technical details
A stored cross-site scripting (XSS) or code injection vulnerability exists in GitLab CE/EE versions 15.11 through 18.11.3. The root cause is improper input sanitization of user-supplied data that is subsequently included in email notifications sent to other users. An authenticated attacker can exploit this by injecting malicious HTML or JavaScript into fields that trigger notifications. When a victim views the resulting email in a vulnerable mail client or web interface, the injected code may execute or render, potentially leading to information disclosure or session hijacking. GitLab has released patches in versions 18.9.7, 18.10.6, and 18.11.3 to address this issue.
Affected products
- GitLab GitLab Community Edition (CE) / Enterprise Edition (EE) 15.11 to < 18.9.7, 18.10 to < 18.10.6, 18.11 to < 18.11.3
Timeline
- 2026-05-13: patched: GitLab released versions 18.9.7, 18.10.6, and 18.11.3
- 2026-05-14: disclosed: Public disclosure of CVE-2025-12669