GitLab CE/EE versions >=18.6.0 <18.6.3 and >=18.7.0 <18.7.1 contain a cross-site scripting vulnerability that allows unauthenticated attackers to execute arbitrary code in an authenticated user's browser context. The vulnerability arises from improper neutralization of input during web page generation. The issue has been fixed in GitLab versions 18.6.3 and 18.7.1. There is no CVSS score provided, but the severity is classified as critical. No known exploits in the wild have been reported. The vendor advisory from Red Hat confirms the vulnerability and remediation versions.

Successful exploitation allows an unauthenticated attacker to execute arbitrary code in the browser context of an authenticated user, potentially leading to session hijacking, data theft, or other malicious actions performed with the user's privileges. This poses a critical risk to the confidentiality and integrity of user sessions and data.

Upgrade GitLab to versions 18.6.3 or later, or 18.7.1 or later, where this vulnerability has been fixed. No other mitigation or temporary workaround is indicated by the vendor advisory.