CVE-2024-10383 Overview
CVE-2024-10383 is a cross-site scripting (XSS) vulnerability in the gitlab-web-ide-vscode-fork component distributed through GitLab's content delivery network. The flaw affects all versions of GitLab Community Edition (CE) and Enterprise Edition (EE) from 15.11 up to 17.3, and temporarily impacted versions 17.4, 17.5, and 17.6. An attacker can trigger script execution in a victim's browser when the victim opens a crafted Jupyter Notebook (.ipynb) file in the GitLab Web IDE. The issue is tracked under [CWE-79] and was reported through HackerOne.
Critical Impact
Successful exploitation allows attackers to execute arbitrary JavaScript in the context of a GitLab user's session, enabling account takeover paths, data theft, and cross-tenant impact within the Web IDE.
Affected Products
- GitLab CE/EE versions 15.11 through 17.2.x
- GitLab CE/EE versions 17.3.x
- GitLab CE/EE versions 17.4, 17.5, and 17.6 (temporarily affected)
Discovery Timeline
- 2025-02-07 - CVE-2024-10383 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-10383
Vulnerability Analysis
The vulnerability resides in the gitlab-web-ide-vscode-fork component, a GitLab-maintained fork of VS Code that powers the GitLab Web IDE. The component is distributed over a CDN, so all GitLab installations pulling the affected asset are exposed regardless of self-hosted patch level for the main Rails application. When the Web IDE renders a Jupyter Notebook (.ipynb) file, notebook cell content is not sufficiently sanitized before being written to the DOM. An attacker who can place an .ipynb file into a repository accessible to a victim can therefore embed HTML or JavaScript payloads that execute when the victim previews the file.
Because the payload runs in the GitLab origin, the attack crosses a trust boundary (Scope: Changed) and can access session context, tokens rendered on the page, and Web IDE APIs. Exploitation requires the victim to open the crafted notebook, which fits normal code-review and repository-browsing workflows.
Root Cause
The root cause is improper neutralization of input during web page generation [CWE-79] in the notebook rendering path of the forked VS Code component. Notebook cell outputs and markdown fields are trusted and inserted into the rendered document without adequate HTML escaping or Content Security Policy enforcement for user-controlled content.
Attack Vector
An attacker crafts a malicious .ipynb file containing HTML or JavaScript in notebook cells. The attacker commits the file to any repository a victim can view, or shares a link to a repository the victim opens. When the victim navigates to the notebook in the Web IDE, the payload is rendered and executed in the browser under the GitLab origin. Consult the GitLab Issue #500785 and the HackerOne Report #2765778 for additional technical context.
Detection Methods for CVE-2024-10383
Indicators of Compromise
- Repositories containing .ipynb files with <script> tags, inline event handlers (for example onerror=, onload=), or javascript: URIs inside cell source or outputs fields
- Web IDE sessions loading gitlab-web-ide-vscode-fork asset versions prior to 1.89.1-1.0.0-dev-20241118094343 from the GitLab CDN
- Unexpected outbound requests from user browsers to attacker-controlled domains shortly after opening a notebook
Detection Strategies
- Scan repositories for .ipynb files and inspect JSON cell content for HTML tags or JavaScript scheme URIs prior to review
- Monitor browser and endpoint telemetry for anomalous JavaScript execution originating from GitLab Web IDE tabs
- Review Content Security Policy violation reports from GitLab clients for blocked inline script attempts
Monitoring Recommendations
- Alert on new or modified .ipynb files in repositories with broad read access, especially in public projects
- Correlate GitLab audit events for Web IDE sessions with browser telemetry to identify unexpected script execution or token exfiltration
- Track the CDN-delivered Web IDE asset version served to clients to confirm patched builds are being loaded
How to Mitigate CVE-2024-10383
Immediate Actions Required
- Upgrade GitLab CE/EE to a version that ships the fixed gitlab-web-ide-vscode-fork build at 1.89.1-1.0.0-dev-20241118094343 or later
- Validate that CDN caches are serving the patched Web IDE asset and purge stale versions if necessary
- Audit recently committed .ipynb files in high-value repositories for embedded HTML or JavaScript
Patch Information
GitLab addressed the issue in gitlab-web-ide-vscode-fork version 1.89.1-1.0.0-dev-20241118094343 and integrated the fix into GitLab CE/EE 17.3 and subsequent 17.4, 17.5, and 17.6 releases. See GitLab Issue #500785 for release mapping and the HackerOne Report #2765778 for the disclosure record.
Workarounds
- Advise users to avoid opening untrusted .ipynb files in the GitLab Web IDE until the patched CDN asset is confirmed
- Restrict Web IDE usage on projects that accept contributions from untrusted external users
- Enforce a stricter Content Security Policy at the reverse proxy to limit inline script execution originating from GitLab pages
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
