Introduction
A cross-site scripting flaw in a core developer workflow can lead to account compromise and unauthorized repository changes. CVE-2025-7734, a high-severity vulnerability in GitLab's blob viewer, shows how a single oversight in input validation can expose entire development teams to attack.
GitLab is a DevOps platform that millions of organizations use for source code management, CI/CD, and collaborative development. Its Community and Enterprise Editions are widely deployed across industries, so a flaw in one of its core components has unusually broad impact.
Technical Information
CVE-2025-7734 is a cross-site scripting (XSS) vulnerability (CWE-79) in the blob viewer component of GitLab CE/EE. The blob viewer renders repository file contents in the web interface, with syntax highlighting, line numbers, and other review features.
The vulnerability comes from insufficient input validation and output encoding when the viewer displays file content or metadata. An attacker who can commit files to a repository could inject a malicious JavaScript payload into file contents, filenames, or associated metadata. When another authenticated user opened the affected file in the blob viewer, the injected script would run in that user's browser session. The attacker could then act on the victim's behalf, for example by modifying repositories, accessing confidential data, or escalating privileges.
The flaw affects all versions of GitLab CE/EE from 14.2 before 18.0.6, 18.1 before 18.1.4, and 18.2 before 18.2.2. The root cause is improper sanitization and encoding in the blob viewer's rendering logic. No public code snippets or PoC are available for this issue.
Patch Information
The latest GitLab patch release (versions 18.2.2, 18.1.4, and 18.0.6) fixes several critical security vulnerabilities, including this one.
Cross-Site Scripting (XSS):
-
Blob Viewer XSS (CVE-2025-7734): Attackers could inject malicious content into the blob viewer and potentially execute actions on behalf of users. The patch adds stricter input validation and output encoding.
-
Labels XSS (CVE-2025-7739): Authenticated users could embed malicious HTML in scoped label descriptions. The update sanitizes all label descriptions before rendering, so they can no longer run unauthorized scripts.
-
Work Item XSS (CVE-2025-6186): Malicious HTML could be injected into work item names, which could lead to account takeover. The fix adds strict validation of work item input and escapes the output.
Permissions and Authorization:
-
Project API Permissions (CVE-2025-8094): Maintainers could manipulate shared infrastructure resources beyond their intended access level and cause denial of service in other users' CI/CD pipelines. The patch revises permission checks in the project API so they enforce proper access controls.
-
Delete Issues Operation (CVE-2024-12303): Users with specific roles could delete issues, including confidential ones, by inviting users with a specific role. The update corrects privilege assignments so that only authorized users can delete issues.
-
Jobs API Authorization (CVE-2024-10219): Authenticated users could bypass access controls and download private artifacts through specific API endpoints. The fix strengthens authorization checks in the jobs API.
Resource Management:
-
Release Name Creation (CVE-2025-2614): Authenticated users could create specially crafted content that consumed excessive server resources and caused denial of service. The patch limits resource allocation during release name creation.
-
Mattermost Integration (CVE-2025-1477): Unauthenticated users could send specially crafted payloads to specific integration API endpoints and cause denial of service. The update adds resource limits and input validation.
Regular Expression Complexity:
- Wiki Feature (CVE-2025-2937): Authenticated users could cause denial of service by sending specially crafted markdown payloads to the Wiki feature. The fix optimizes regular expression handling to prevent the inefficient processing that could lead to resource exhaustion.
Other Fixes:
-
Merge Request Approval Policy (CVE-2025-8770): Authenticated users with specific access could bypass merge request approval policies by manipulating approval rule identifiers. The patch validates approval rules more strictly.
-
ID Token Permissions (CVE-2025-5819): Under certain circumstances, users with developer access could obtain ID tokens for protected branches. The update adjusts permission assignments so that only authorized users can access ID tokens.
-
IP Restriction Bypass (CVE-2025-2498): Users could bypass IP restrictions and view assigned issues from restricted groups. The fix makes access controls respect IP restriction settings consistently.
Patch source: GitLab 18.2.2 Patch Release
Affected Systems and Versions
- GitLab Community Edition (CE) and Enterprise Edition (EE)
- Versions from 14.2 before 18.0.6
- Versions 18.1 before 18.1.4
- Versions 18.2 before 18.2.2
Every configuration that uses the blob viewer in these versions is vulnerable.
Vendor Security History
GitLab has fixed similar cross-site scripting vulnerabilities in the blob viewer and related components before. CVE-2021-22220, for example, was a stored XSS in the blob viewer for notebooks. GitLab runs a mature vulnerability disclosure and patch management process, with coordinated releases across supported branches and detailed advisories. It generally responds promptly to reported vulnerabilities, and its security advisories are transparent and practical to act on.
