A stored cross-site scripting (XSS) vulnerability exists in GitLab CE/EE versions starting from 16.9 before 16.9.4 and from 16.10 before 16.10.2. The flaw occurs in the diff viewer component and allows an attacker to inject malicious scripts that execute arbitrary actions on behalf of victims.