GitLab CE/EE versions 16.7.0 up to 16.8.6, 16.9.0 up to 16.9.4, and 16.10.0 up to 16.10.2 contain a stored cross-site scripting (XSS) vulnerability. This occurs via the autocomplete for issues references feature, where a crafted payload can be stored and executed, potentially allowing attackers to perform arbitrary actions on behalf of victims.