CVE-2025-6186: 
GitLab vulnerability analysis and mitigation

An issue has been discovered in GitLab CE/EE affecting all versions from 18.1 before 18.1.4, and 18.2 before 18.2.2 that could have allowed authenticated users to achieve account takeover by injecting malicious HTML into work item names (GitLab Release, NVD).

The vulnerability is classified as a Cross-site Scripting (XSS) issue, identified as CWE-79 (Improper Neutralization of Input During Web Page Generation). The CVSS v3.1 base score is 8.7 (High) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N, indicating a network-exploitable vulnerability requiring low attack complexity and user interaction (GitLab Release).

The vulnerability could allow authenticated users to achieve account takeover through the injection of malicious HTML into work item names. This could potentially lead to unauthorized access and control of other user accounts within the GitLab instance (GitLab Release).

GitLab has released patches to address this vulnerability in versions 18.1.4 and 18.2.2. It is strongly recommended that all affected installations be upgraded to these versions immediately. GitLab.com is already running the patched version, and GitLab Dedicated customers do not need to take action (GitLab Release).