Vulnerabilities
GitLab 17.9.1/17.8.4/17.7.6 Patch: XSS in k8s Proxy and HTML Injection in Maven Proxy
GitLab released patch versions 17.9.1, 17.8.4, and 17.7.6 on Feb 26 2025 to address high‑severity XSS vulnerabilities in the Kubernetes proxy endpoint and HTML injection in the Maven Dependency Proxy. Self‑managed CE/EE installations must upgrade immediately; GitLab.com and Dedicated customers are already patched.
What happened
On Feb 26 2025 GitLab released patch releases 17.9.1, 17.8.4, and 17.7.6 for both Community and Enterprise editions. The updates fix two high‑severity vulnerabilities: an XSS flaw in the Kubernetes proxy endpoint and an HTML injection flaw in the Maven Dependency Proxy.
Impact
All self‑managed GitLab installations running any of the affected versions are vulnerable. The XSS issue allows attackers to inject malicious scripts via the k8s proxy endpoint, potentially compromising user sessions. The HTML injection flaw can be exploited through the Maven proxy to inject arbitrary HTML into responses.
What to do
- Verify your GitLab version. If you are on 17.9.x, 17.8.x, or 17.7.x and have not yet applied the patch, upgrade to 17.9.1, 17.8.4, or 17.7.6 respectively.
- For omnibus, source, or Helm deployments, follow the standard upgrade procedure documented in the GitLab release notes.
- After upgrading, confirm that the k8s proxy endpoint and Maven proxy are no longer reachable via the vulnerable paths.
- Review audit logs for any suspicious activity during the period before the patch.
Additional notes
GitLab.com is already running the patched version, and Dedicated customers do not need to take action. Security advisories for these fixes will be published on the issue tracker 30 days after release.
Related vulnerabilities
Splunk Classic Dashboard XSS Allows Low‑Privilege User to Inject JavaScript
A stored XSS flaw in Splunk classic dashboards lets a non‑admin user embed malicious script that runs in another user's browser when the dashboard is opened. The issue exists in pre‑10.2.4, pre‑10.0.7, pre‑9.4.12, and pre‑9.3.13 Enterprise releases and corresponding Cloud Platform versions. Defenders should patch immediately or disable HTML panels.
Read briefing
GitLab Security Advisory: 16.6.1, 16.5.3, 16.4.3 Patch for XSS and ReDoS Vulnerabilities
GitLab released security patches 16.6.1, 16.5.3, and 16.4.3 to address critical XSS and ReDoS flaws in the Banzai Markdown pipeline and a privilege escalation flaw involving the admin_group_member custom permission. All Community Edition and Enterprise Edition installations below these versions are affected. Immediate upgrade is required.
Read briefing
Chromium CVE-2026-106416: Code Injection Vulnerability in Edge Chromium
A code injection flaw in Chromium (CVE‑2026‑106416) can be exploited via malicious web pages. Microsoft Edge (Chromium‑based) is affected and must be updated to the latest version. Defenders should verify Edge versions and apply the patch promptly.
Read briefing
GitLab 16.9.8 Patch Release: Bug Fixes, No Security Updates
On May 9 2024 GitLab released 16.9.8 for Community and Enterprise Editions. The update addresses regressions and bugs but contains no security fixes. Defenders should apply the patch, review the auto‑reconfigure behavior, and use /etc/gitlab/skip‑auto‑reconfigure to avoid downtime in multi‑node setups.
Read briefing