GitLab CE/EE contained a stored cross-site scripting vulnerability identified as CVE-2025-9222. The flaw affected multiple version ranges: >=18.2.2 <18.5.5, >=18.6.0 <18.6.3, and >=18.7.0 <18.7.1. An authenticated user could exploit GitLab Flavored Markdown to inject malicious scripts that would be stored and executed in the context of other users viewing the content. This vulnerability has been fixed in versions 18.5.5, 18.6.3, and 18.7.1 and later.

An authenticated user could achieve stored cross-site scripting, potentially leading to script execution in other users' browsers when viewing affected content. This could result in session hijacking, unauthorized actions, or other impacts typical of XSS vulnerabilities. However, exploitation requires authentication.

The vulnerability has been officially fixed in GitLab versions 18.5.5, 18.6.3, and 18.7.1 and later. Users should upgrade to these or newer versions to remediate the issue. No additional vendor advisory indicates alternative mitigations or that no action is required.