GitLab Patches Multiple Vulnerabilities Enabling DoS and Cross-Site Scripting Attacks

GitLab, a popular platform for code collaboration, just rolled out urgent security patches for its Community Edition (CE) and Enterprise Edition (EE).

These fixes target versions 18.8.4, 18.7.4, and 18.6.6. They fix serious bugs that hackers could use for denial-of-service (DoS) attacks, cross-site scripting (XSS), and even stealing sensitive data like access tokens.

Why does this matter? GitLab powers millions of developers worldwide. A single flaw could let attackers crash services, steal private code, or trick users into running malicious scripts.

Self-managed users those running GitLab on their own servers must update fast. GitLab.com is already safe, and Dedicated customers need no action.

Key Vulnerabilities Fixed

The star of this patch is CVE-2025-7659, rated 8.0 on the CVSS scale (that’s high severity). It’s an “incomplete validation” bug in the Web IDE, GitLab’s online code editor.

Unauthenticated attackers, no login needed, could grab tokens to sneak into private repos. Imagine your secret project code exposed; that’s the risk to intellectual property.

DoS bugs were next. CVE-2025-8099 (CVSS 7.5) hits GraphQL introspection, where endless queries overload and crash the server.

CVE-2026-0958 (also 7.5) skips JSON checks in middleware, exhausting memory or CPU, like flooding a pipe until it bursts.

XSS and injection issues round it out. CVE-2025-14560 (7.3) allows script injection in Code Flow, potentially hijacking sessions. CVE-2026-0595 (7.3) slips HTML into test case titles, letting attackers push fake content.

Lower but still risky: More DoS in Markdown tools and dashboards, plus server-side request forgery (SSRF) that could probe internal networks.

CVE ID	Vulnerability Description	Product	CVSS Score
CVE-2025-7659	Incomplete Validation in Web IDE	CE/EE	8.0
CVE-2025-8099	DoS in GraphQL introspection	CE/EE	7.5
CVE-2026-0958	DoS in JSON validation middleware	CE/EE	7.5
CVE-2025-14560	XSS in Code Flow	CE/EE	7.3
CVE-2026-0595	HTML Injection in test case titles	CE/EE	7.3
CVE-2026-1458	DoS in Markdown processor	CE/EE	6.5
CVE-2026-1456	DoS in Markdown Preview	CE/EE	6.5
CVE-2026-1387	DoS in Dashboard	EE	6.5
CVE-2025-12575	SSRF in Virtual Registry	EE	5.4
CVE-2026-1094	Improper Validation in diff parser	CE/EE	4.6
CVE-2025-12073	SSRF in Git repository import	CE/EE	4.3
CVE-2026-1080	Authorization Bypass in iterations API	EE	4.3

Upgrade now to dodge these threats. Check GitLab’s release notes for details. Admins, scan your setup and test in staging first.

This patch wave shows why timely updates beat exploits; hackers scan for old versions daily.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.