A cross-site scripting (XSS) vulnerability exists in GitLab EE versions from 16.4 up to but not including 18.9.7, 18.10 up to 18.10.6, and 18.11 up to 18.11.3. This flaw allows an authenticated user with developer-role permissions to execute arbitrary JavaScript in other users' browsers due to improper input sanitization. The issue has been remediated in the specified fixed versions.