PT-2025-50584 · Gitlab · Gitlab Ce/Ee

X0Abcd · Published 2025-12-10 · Updated 2025-12-15 · CVE-2025-12029

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 15.11 through 18.4.6 GitLab CE/EE versions 18.5 through 18.5.4 GitLab CE/EE versions 18.6 through 18.6.2

Description GitLab CE/EE is affected by an issue that, under certain circumstances, could allow an unauthenticated user to perform unauthorized actions on behalf of another user. This is possible through the injection of malicious external scripts into the Swagger UI. The issue is related to improper neutralization of input during web page generation, specifically a Cross-site Scripting condition.

Recommendations GitLab CE/EE versions 15.11 through 18.4.6 should be updated to a version later than 18.4.6. GitLab CE/EE versions 18.5 through 18.5.4 should be updated to a version later than 18.5.4. GitLab CE/EE versions 18.6 through 18.6.2 should be updated to a version later than 18.6.2.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2025-15867

BIT-GITLAB-2025-12029

CVE-2025-12029

Affected Products

Gitlab Ce/Ee

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/12xxx/CVE-2025-12029.json · Exploit
• 🔥 https://hackerone.com/reports/3317485 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-12029 · Security Note
• https://about.gitlab.com/releases/2025/12/10/patch-release-gitlab-18-6-2-released · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-12029 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-15867 · Security Note
• https://t.me/CVEtracker/39462 · Telegram Post
• https://t.me/cveNotify/145414 · Telegram Post
• https://twitter.com/Hossted_OSS/status/2000391220213014981 · Twitter Post
• https://twitter.com/CVEnew/status/1999108864822911374 · Twitter Post
• https://gitlab.com/gitlab-org/gitlab/-/issues/577975 · Note