Introduction
A script injected into a GitLab label can silently compromise developers who view the project, putting their sessions and repository access at risk. CVE-2025-7739 is a high-severity stored cross-site scripting vulnerability in the scoped label description feature of GitLab CE/EE versions 18.2 before 18.2.2. An authenticated user can store arbitrary JavaScript that later runs in the context of other users, including privileged project maintainers and administrators.
GitLab is a widely adopted DevSecOps platform for source code management, CI/CD, and project collaboration, used by organizations of all sizes. Labels, and scoped labels in particular, are central to how projects are organized and how workflows are automated. A vulnerability in them is especially damaging for teams that rely on GitLab for secure development.
Technical Information
CVE-2025-7739 comes from improper sanitization of user-supplied HTML in the description field of scoped labels. When an authenticated user creates or edits a scoped label (one that uses the double-colon syntax, such as priority::high), they can put malicious HTML or JavaScript in the description. GitLab stores this content in its database and renders it in the web interface without sufficient output encoding.
When another user views a page that displays the label, their browser runs the injected script in the context of their session. This can lead to session hijacking, privilege escalation, or unauthorized actions taken on the victim's behalf. Exploitation requires authentication, but any user with permission to create or edit scoped labels in a project or group can carry it out.
The root cause is that GitLab did not sanitize or escape HTML in label descriptions at either the input or the output stage. No public code snippets are available for this issue. The vulnerability affects only the description field of scoped labels, not other label fields or unrelated GitLab features.
Patch Information
GitLab has released fixes for this and other vulnerabilities in the following versions:
- 18.2.2 (and later)
- 18.1.4 (and later)
- 18.0.6 (and later)
For CVE-2025-7739, upgrade to GitLab CE/EE 18.2.2 or newer. That release fixes the stored XSS in scoped label descriptions. Full details are in the GitLab 18.2.2 Patch Release Advisory.
Affected Systems and Versions
- GitLab Community Edition (CE) and Enterprise Edition (EE)
- Versions 18.2 before 18.2.2
- Only the scoped label description feature is affected
- Any configuration where users can create or edit scoped labels is vulnerable
Vendor Security History
GitLab has a documented history of cross-site scripting issues in its label management features. Earlier vulnerabilities include stored XSS in label colors and descriptions (see GitLab Issue 291004 and GitLab Issue 370873). GitLab runs a public bug bounty program and typically ships coordinated security patches and advisories. It generally patches quickly, but similar issues keep recurring, which suggests ongoing trouble with input validation and output encoding wherever users supply content.
