GitLab CE/EE versions from 15.7 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 contain a vulnerability where improper sanitization of user-supplied input allows an authenticated user to execute arbitrary scripts in another user's browser session. This vulnerability enables cross-site scripting (XSS) attacks that can compromise confidentiality and integrity of user sessions. The vulnerability is present in specific Ubuntu package versions 8.4.3+dfsg-9, 8.4.3+dfsg-12, and 8.5.8+dfsg-5 as noted. No known exploits in the wild have been reported.

Successful exploitation allows an authenticated user to execute arbitrary scripts in another user's browser session, potentially leading to session hijacking, data theft, or unauthorized actions within the affected GitLab instance. The confidentiality and integrity of user sessions are at high risk, though availability is not impacted.

GitLab has remediated this vulnerability in versions 18.11.7, 19.0.4, and 19.1.2 and later. Users should upgrade to these fixed versions or later to mitigate the risk. Patch status is not explicitly confirmed for the Ubuntu package versions listed; therefore, users should consult the official Ubuntu or GitLab advisories for the latest remediation guidance.