GitLab Patches Vulnerabilities
A critical security update has been released for both the Community Edition (CE) and Enterprise Edition (EE) to address multiple high-severity vulnerabilities.
The patches, available in versions 18.8.4, 18.7.4, and 18.6.6, fix flaws that could allow attackers to crash servers, steal data, or hijack user sessions.
Security experts urge administrators of self-managed instances to upgrade immediately, noting that GitLab.com has already been patched.
The most severe vulnerability, tracked as CVE-2025-7659 (CVSS 8.0), lies in the Web IDE. This flaw involves “incomplete validation,” meaning the system fails to verify who is accessing certain data properly.
An unauthenticated attacker, someone without a username or password, could exploit this to steal access tokens and view private software repositories.
| CVE ID | Severity | Type | Description |
|---|---|---|---|
| CVE-2025-7659 | High (8.0) | Token Theft | Unauthenticated access to private tokens via Web IDE. |
| CVE-2025-8099 | High (7.5) | DoS | Service crash via repeated GraphQL queries. |
| CVE-2026-0958 | High (7.5) | DoS | Resource exhaustion via JSON validation bypass. |
| CVE-2025-14560 | High (7.3) | XSS | malicious script injection in Code Flow. |
The update also resolves two dangerous Denial-of-Service (DoS) issues. In a DoS attack, a hacker tries to overwhelm a system to knock it offline.
CVE-2025-8099 (CVSS 7.5) allows attackers to crash the service by sending repeated, complex queries to the GraphQL interface.
CVE-2026-0958 (CVSS 7.5) exploits the JSON validation middleware, letting attackers exhaust the server’s memory or CPU.
Another major fix addresses CVE-2025-14560 (CVSS 7.3), a Cross-Site Scripting (XSS) vulnerability in the “Code Flow” feature. XSS flaws allow attackers to inject malicious scripts into trusted websites.
In this case, an attacker could hide code that executes when another user views it, potentially allowing them to perform actions on behalf of that victim.
GitLab strongly recommends that all customers running affected versions upgrade to the latest patch immediately.
While the update fixes these critical issues, it also addresses several medium-severity bugs, including Server-Side Request Forgery (SSRF) and HTML injection flaws.
Administrators should be aware that upgrading single-node instances may require brief downtime for database migrations.
Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.
Hackers are actively probing AI systems, turning exposed gateways and agent tools into routes for…
Hackers are making some phishing pages harder to track by changing the code delivered to…
A cyber incident reportedly forced a British power plant to halt operations for about four…
Russian hackers have used a new backdoor called HOOKEDGE to target defense manufacturers, government bodies,…
TITAN ransomware is pairing file encryption with an ambitious claim: artificial intelligence that can sort…
A fake student resume is being used to place a remote-access tool on researchers’ Windows…