CVE-2025-7734 Overview
CVE-2025-7734 is a stored cross-site scripting (XSS) vulnerability affecting GitLab Community Edition (CE) and Enterprise Edition (EE). The flaw allows an authenticated attacker to inject malicious content that executes in the context of other users' browser sessions. Under certain conditions, this enables the attacker to perform actions on behalf of victims. The vulnerability affects all versions from 14.2 before 18.0.6, 18.1 before 18.1.4, and 18.2 before 18.2.2. GitLab addressed the issue in the corresponding patch releases. The weakness is classified as [CWE-79] Improper Neutralization of Input During Web Page Generation.
Critical Impact
Authenticated attackers can inject content that triggers arbitrary actions in the browser sessions of other GitLab users, resulting in cross-scope impact within the application.
Affected Products
- GitLab CE/EE versions 14.2 up to (but not including) 18.0.6
- GitLab CE/EE versions 18.1 up to (but not including) 18.1.4
- GitLab CE/EE versions 18.2 up to (but not including) 18.2.2
Discovery Timeline
- 2025-08-13 - CVE-2025-7734 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-7734
Vulnerability Analysis
The vulnerability is a stored content injection issue in GitLab CE/EE that maps to [CWE-79]. GitLab renders certain user-supplied fields without fully neutralizing markup or script constructs. When another authenticated user views the affected surface, the injected payload executes in their browser context. Because the scope changes (S:C) during exploitation, the injected code can reach resources beyond the initially vulnerable component. This enables the attacker to perform state-changing actions using the victim's authenticated session, including API calls that rely on the victim's privileges. The impact is limited to low-integrity and low-confidentiality outcomes because same-origin controls and GitLab's session model constrain what a payload can achieve.
Root Cause
The root cause is insufficient output encoding or sanitization of user-controlled content in a GitLab UI surface. Input that should be treated as inert text is rendered as active markup, allowing script or event-handler injection. GitLab's advisory (issue #556090) and the associated HackerOne report (#3247096) document the specific component but require login to access full details.
Attack Vector
Exploitation requires an authenticated attacker with low privileges and victim interaction, such as viewing a project page, issue, merge request, or other GitLab object that renders the injected content. The attacker stores a payload through a normal GitLab workflow. When a victim navigates to the affected view, the payload executes in the victim's browser. The payload can then invoke GitLab APIs with the victim's session, modify project data, or exfiltrate limited information exposed to the browser.
No verified proof-of-concept code is publicly available. For technical details, see the GitLab Issue #556090 and the HackerOne Report #3247096.
Detection Methods for CVE-2025-7734
Indicators of Compromise
- Unexpected changes to GitLab objects (issues, merge requests, snippets, wiki pages) performed under legitimate user accounts without corresponding user activity.
- Outbound HTTP requests from browsers viewing GitLab content to attacker-controlled domains not present in normal traffic baselines.
- GitLab audit events showing API actions originating from browser sessions immediately after a user viewed a specific object.
Detection Strategies
- Review GitLab audit logs and Rails production logs for HTML or JavaScript fragments in fields that normally contain plain text, such as descriptions, titles, and comments.
- Inspect stored records in the GitLab database for tags such as <script>, <img onerror=, javascript:, and encoded variants in user-supplied fields.
- Correlate user viewing activity with subsequent unexpected API calls made by the same session within a short time window.
Monitoring Recommendations
- Enable and centralize GitLab application, audit, and web server logs in a SIEM for correlation across users and projects.
- Monitor the GitLab version banner and version API to confirm all instances run patched releases 18.0.6, 18.1.4, or 18.2.2 and later.
- Alert on Content Security Policy (CSP) violation reports generated by GitLab pages, which can indicate injected script execution attempts.
How to Mitigate CVE-2025-7734
Immediate Actions Required
- Upgrade self-managed GitLab CE/EE instances to 18.0.6, 18.1.4, or 18.2.2, matching the appropriate release branch.
- Audit recently created or modified issues, merge requests, comments, and wiki pages for suspicious HTML or JavaScript content.
- Rotate personal access tokens and session cookies for users who may have viewed attacker-controlled content prior to patching.
Patch Information
GitLab released fixed versions 18.0.6, 18.1.4, and 18.2.2. GitLab.com SaaS is patched by the vendor. Self-managed administrators should follow the standard GitLab upgrade path for their edition and installation method (Omnibus, Helm, source, or Docker). Consult the GitLab Issue #556090 for advisory details.
Workarounds
- Restrict project and group membership so that untrusted users cannot post content into projects viewed by privileged users until patches are applied.
- Enforce a strict Content Security Policy on the GitLab instance to limit inline script execution where compatible with the deployment.
- Require reviewers to inspect raw markdown or diff views of untrusted contributions before opening rendered views in the web UI.
# Example: verify GitLab version on an Omnibus install
sudo gitlab-rake gitlab:env:info | grep -i "GitLab information" -A 5
# Example: upgrade Omnibus GitLab on Debian/Ubuntu to a fixed release
sudo apt-get update
sudo apt-get install --only-upgrade gitlab-ee=18.2.2-ee.0
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
