GitLab EE versions 13.11 up to but not including 18.11.7, 19.0 up to but not including 19.0.4, and 19.1 up to but not including 19.1.2 contain a vulnerability where improper sanitization of user-supplied input allows an authenticated developer-role user to execute arbitrary scripts in another user's browser session. This cross-site scripting (XSS) vulnerability could compromise user confidentiality and integrity. The affected Ubuntu packages include versions =8.4.3+dfsg-9, =8.4.3+dfsg-12, and =8.5.8+dfsg-5. There is no indication of known exploits in the wild. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, user interaction required, scope changed, and high confidentiality and integrity impact with no availability impact.

Successful exploitation allows an authenticated user with developer permissions to execute arbitrary scripts in another user's browser session, potentially leading to theft or manipulation of sensitive information and unauthorized actions performed on behalf of the victim user. The vulnerability impacts confidentiality and integrity but does not affect system availability. No known active exploits have been reported.

A fix is available in GitLab EE versions 18.11.7, 19.0.4, and 19.1.2 and later. Users should upgrade affected GitLab installations to these or newer versions to remediate the vulnerability. Since this is not a cloud service, manual patching by administrators is required. Patch status for the Ubuntu packages should be verified with the Ubuntu vendor advisory for official updates.