Gitlab · Gitlab Ce/Ee · CVE-2018-17537
**Name of the Vulnerable Software and Affected Versions**
GitLab Community and Enterprise Edition versions 11.1.7 and earlier, 11.2.x through 11.2.3, 11.3.x through 11.3.0
**Description**
An issue was discovered in GitLab Community and Enterprise Edition, where blog-viewer has stored XSS during repository browsing, if package.json exists.
**Recommendations**
For versions 11.1.7 and earlier, update to version 11.1.7 or later.
For versions 11.2.x through 11.2.3, update to version 11.2.4 or later.
For versions 11.3.x through 11.3.0, update to version 11.3.1 or later.
As a temporary workaround, consider restricting access to the blog-viewer feature until a patch is available.