Introduction
A single malicious work item in GitLab can lead to account takeover through CVE-2025-6186. Any authenticated user can inject HTML into a work item name, and that HTML can compromise anyone who views the item, administrators included. For organizations that run their source code and DevOps workflows on GitLab, the flaw puts both project integrity and user accounts at risk.
Technical Information
CVE-2025-6186 is a stored cross-site scripting (XSS) vulnerability (CWE-79) affecting GitLab Community Edition and Enterprise Edition. The vulnerability is in the work item name field. Authenticated users can inject arbitrary HTML into this field when they create or edit a work item. GitLab stores the payload in the database and renders it unescaped in the web interface when other users view the work item.
The attacker needs a valid GitLab account. Once the payload is in place, the injected HTML executes in the browser context of any user with access to the compromised work item. From there, an attacker can steal session cookies, execute arbitrary JavaScript, or perform actions on the victim's behalf. If the victim is an administrator, that includes privilege escalation and account takeover.
The root cause is insufficient input validation and output encoding on the work item name field. GitLab has had similar XSS vulnerabilities in other user-controllable fields, such as status checks, user names, and integration points. The pattern shows how hard it is to sanitize every input in a complex web application.
Patch Information
GitLab has fixed the vulnerability in these versions:
- 18.2.2
- 18.1.4
- 18.0.6
To fully remediate CVE-2025-6186, upgrade to one of these versions or later. The same patch release also fixes other XSS and permission issues. The official advisory has the full details: https://about.gitlab.com/releases/2025/08/13/patch-release-gitlab-18-2-2-released/
Affected Systems and Versions
- GitLab Community Edition (CE) and Enterprise Edition (EE)
- All versions from 18.1 before 18.1.4
- All versions from 18.2 before 18.2.2
Other branches, such as 18.0.x, are not affected by this vulnerability, but they should still be kept up to date for other security fixes.
Vendor Security History
GitLab has a history of recurring XSS vulnerabilities in several components, including:
- Status checks widgets (see https://gitlab.com/gitlab-org/gitlab/-/issues/367408)
- Jira integration (see https://gitlab.com/gitlab-org/gitlab/-/issues/359142)
- User name and profile fields (see https://gitlab.com/gitlab-org/gitlab/-/issues/25751)
GitLab runs a public bug bounty program and typically responds quickly to reports, with coordinated patch releases and detailed advisories. Even so, the frequency of input sanitization flaws points to ongoing gaps in its secure development lifecycle.
