CVE-2025-12029

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.11 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have, under certain circumstances, allowed an unauthenticated user to perform unauthorized actions on behalf of another user by injecting malicious external scripts into the Swagger UI."

CVSS v3 8.0 HIGH

8.0^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.6 / Impact : 5.8

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://about.gitlab.com/releases/2025/12/10/patch-release-gitlab-18-6-2-released/	Release Notes Vendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/577975	Broken Link
https://hackerone.com/reports/3317485	Permissions Required

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:gitlab:gitlab:::::community:::*
	cpe:2.3:a:gitlab:gitlab:::::enterprise:::*
	cpe:2.3:a:gitlab:gitlab:::::community:::*
	cpe:2.3:a:gitlab:gitlab:::::enterprise:::*
	cpe:2.3:a:gitlab:gitlab:::::community:::*
	cpe:2.3:a:gitlab:gitlab:::::enterprise:::*

History

14 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) GitLab ha remediado un problema en GitLab CE/EE que afecta a todas las versiones desde la 15.11 anteriores a la 18.4.6, la 18.5 anteriores a la 18.5.4, y la 18.6 anteriores a la 18.6.2 que podría haber permitido, bajo ciertas circunstancias, a un usuario no autenticado realizar acciones no autorizadas en nombre de otro usuario mediante la inyección de scripts externos maliciosos en la Swagger UI.

Information

Published : 2025-12-11 08:15

Updated : 2026-10-14 21:10

NVD link : CVE-2025-12029

Mitre link : CVE-2025-12029

CVE.ORG link : CVE-2025-12029

JSON object : View

Products Affected

gitlab

gitlab

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2025-12029", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12029", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-12-12T04:55:45.314598Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cve@gitlab.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.0, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.8, "exploitabilityScore": 1.6}]}, "affected": [{"source": "cve@gitlab.com", "affectedData": [{"cpes": ["cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"], "repo": "git://git@gitlab.com:gitlab-org/gitlab.git", "vendor": "GitLab", "product": "GitLab", "versions": [{"status": "affected", "version": "15.11", "lessThan": "18.4.6", "versionType": "semver"}, {"status": "affected", "version": "18.5", "lessThan": "18.5.4", "versionType": "semver"}, {"status": "affected", "version": "18.6", "lessThan": "18.6.2", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2025-12-11T08:15:47.853", "references": [{"url": "https://about.gitlab.com/releases/2025/12/10/patch-release-gitlab-18-6-2-released/", "tags": ["Release Notes", "Vendor Advisory"], "source": "cve@gitlab.com"}, {"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/577975", "tags": ["Broken Link"], "source": "cve@gitlab.com"}, {"url": "https://hackerone.com/reports/3317485", "tags": ["Permissions Required"], "source": "cve@gitlab.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "cve@gitlab.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.11 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have, under certain circumstances, allowed an unauthenticated user to perform unauthorized actions on behalf of another user by injecting malicious external scripts into the Swagger UI.\""}, {"lang": "es", "value": "GitLab ha remediado un problema en GitLab CE/EE que afecta a todas las versiones desde la 15.11 anteriores a la 18.4.6, la 18.5 anteriores a la 18.5.4, y la 18.6 anteriores a la 18.6.2 que podr\u00eda haber permitido, bajo ciertas circunstancias, a un usuario no autenticado realizar acciones no autorizadas en nombre de otro usuario mediante la inyecci\u00f3n de scripts externos maliciosos en la Swagger UI."}], "lastModified": "2026-10-14T21:10:00.183", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "vulnerable": true, "matchCriteriaId": "91412C68-DC13-44A6-B63E-77899AA6AF82", "versionEndExcluding": "18.4.6", "versionStartIncluding": "15.11.0"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "B3283CA0-78EA-4D53-92B4-B3DBF4BDB430", "versionEndExcluding": "18.4.6", "versionStartIncluding": "15.11.0"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "vulnerable": true, "matchCriteriaId": "457DB333-60BE-44CD-A674-216AB658E14E", "versionEndExcluding": "18.5.4", "versionStartIncluding": "18.5.0"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "910967DB-0A8C-4436-9D9E-37BD610E7367", "versionEndExcluding": "18.5.4", "versionStartIncluding": "18.5.0"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "vulnerable": true, "matchCriteriaId": "919A2588-3EA1-4E15-B47E-61B3E14B2781", "versionEndExcluding": "18.6.2", "versionStartIncluding": "18.6.0"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "6343A083-3E1C-4551-B230-76CABC3FDD67", "versionEndExcluding": "18.6.2", "versionStartIncluding": "18.6.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@gitlab.com"}