CVE-2025-8405
Improper Encoding or Escaping of Output in GitLab
GitLab has remediated a security issue in GitLab CE/EE affecting all versions from 17.1 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have allowed an authenticated user to perform unauthorized actions on behalf of other users by injecting malicious HTML into vulnerability code flow displays.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Improper Encoding or Escaping of Output in GitLab
GitLab has remediated a security issue in GitLab CE/EE affecting all versions from 17.1 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have allowed an authenticated user to perform unauthorized actions on behalf of other users by injecting malicious HTML into vulnerability code flow displays.
- Record
CVE-2025-8405- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N - Weakness
- CWE-116
- Updated
- 2026-11-04
EUVDEUVD-2025-202646
GitLab has remediated a security issue in GitLab CE/EE affecting all versions from 17.1 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have allowed an authenticated user to perform unauthorized actions on behalf of other users by injecting malicious HTML into vulnerability code flow displays.
- Record
EUVD-2025-202646- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N - Updated
- 2026-11-04
GitHub AdvisoriesGHSA-fjj2-x466-w3hx
GitLab has remediated a security issue in GitLab CE/EE affecting all versions from 17.1 before 18...
GitLab has remediated a security issue in GitLab CE/EE affecting all versions from 17.1 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have allowed an authenticated user to perform unauthorized actions on behalf of other users by injecting malicious HTML into vulnerability code flow displays.
- Record
GHSA-fjj2-x466-w3hx- CVSS 3.1
- 8.7 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N - Weakness
- CWE-116
- Updated
- 2026-11-02
NVD
GitLab has remediated a security issue in GitLab CE/EE affecting all versions from 17.1 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have allowed an authenticated user to perform unauthorized actions on behalf of other users by injecting malicious HTML into vulnerability code flow displays.
- Record
CVE-2025-8405- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N - Weakness
- CWE-116
- Updated
- 2026-11-02
OSV
Improper Encoding or Escaping of Output in GitLab
GitLab has remediated a security issue in GitLab CE/EE affecting all versions from 17.1 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have allowed an authenticated user to perform unauthorized actions on behalf of other users by injecting malicious HTML into vulnerability code flow displays.
- Record
CVE-2025-8405- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N - Weakness
- CWE-116
- Updated
- 2026-11-04
OSVUBUNTU-CVE-2025-8405
GitLab has remediated a security issue in GitLab CE/EE affecting all versions from 17.1 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have allowed an authenticated user to perform unauthorized actions on behalf of other users by injecting malicious HTML into vulnerability code flow displays.
- Record
UBUNTU-CVE-2025-8405- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N - Updated
- 2026-11-02
OSVBIT-gitlab-2025-8405 No score
Improper Encoding or Escaping of Output in GitLab
GitLab has remediated a security issue in GitLab CE/EE affecting all versions from 17.1 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have allowed an authenticated user to perform unauthorized actions on behalf of other users by injecting malicious HTML into vulnerability code flow displays.
- Record
BIT-gitlab-2025-8405- Updated
- 2026-11-02
Affected products
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | CVE List, EUVD | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-8405 is a high vulnerability (CVSS 7.7) in Gitlab, published December 11, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.52%, the 44th percentile. Fixed in gitlab 18.4.6.
References
gitlab.com/gitlab-org/gitlab/-/issues/558214
hackerone.com/reports/3270940
about.gitlab.com/releases/2025/12/10/patch-release-gitlab-18-6-2-released
nvd.nist.gov/vuln/detail/CVE-2025-8405
github.com/advisories/GHSA-fjj2-x466-w3hx
ubuntu.com/security/CVE-2025-8405
cve.org/CVERecord?id=CVE-2025-8405