Summary
generated automatically from NVD dataGitLab 6.0 and other releases prior to 6.5.0 contain a cross-site scripting (XSS) flaw, classified as CWE-79. A remote attacker could supply a specially crafted HTML file, such as README.html, to inject arbitrary web script or HTML into pages viewed by users. The issue has a CVSS v2.0 score of 4.3 (MEDIUM), with network access, medium complexity, and a limited integrity impact.
NVD description
Cross-site scripting (XSS) vulnerability in GitLab 6.0 and other versions before 6.5.0 allows remote attackers to inject arbitrary web script or HTML via a crafted HTML file, as demonstrated by README.html.
EPSS · FIRST.org
1.8%probability of exploitation in the next 30 days
Higher than 78% of scored CVEs
EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-30, recomputed daily by FIRST.org.
CVSS v2.0 Score
Information
- Published
- 24 janv. 2014
- Updated
- 17 juin 2026
- Status
- Modified
- Source
- cve@mitre.org
Affected products
Bounds published by NVD: "< 8.4.27" means 8.4.27 is no longer vulnerable. The fixed release to install is in the vendor advisory.
Weaknesses (CWE)
References (8)
Similar CVEs
Other vulnerabilities of type CWE-79
Know which CVEs hit the versions you run.
Add the product and its version: cveo.tech lists the CVEs that affect it right away, then alerts you by email when a new one affects it — including before NVD has finished its analysis. Free, an account is all it takes.