CVE-2024-2279: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2024-04-12 · updated 2026-06-17
Weakness: CWE-79

Description

An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.7 to 16.8.6 all versions starting from 16.9 before 16.9.4, all versions starting from 16.10 before 16.10.2. Using the autocomplete for issues references feature a crafted payload may lead to a stored XSS, allowing attackers to perform arbitrary actions on behalf of victims.

Affected products

GitLab: from 16.7.0 before 16.8.6; from 16.9.0 before 16.9.4; from 16.10.0 before 16.10.2 — fixed in 16.10.2, 16.8.6, 16.9.4

How to fix

Upgrade to a fixed version: GitLab 16.10.2, 16.8.6, 16.9.4. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-2279 or the next vulnerability affects your stack