CVE-2022-1190: GitLab stored XSS via multi-word milestone references

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

medium priorityCVSS rates it medium (5.4) and it requires authentication plus victim interaction, but the very high EPSS score and stored nature raise the practical risk.

What it is

GitLab CE/EE mishandles user input when rendering multi-word milestone references in issue descriptions, comments and similar fields, allowing stored cross-site scripting. The flaw affects versions 8.3 before 14.7.7, 14.8 before 14.8.5, and 14.9 before 14.9.2. Because the payload persists in project content, it can fire for other users who view the affected page.

Impact

An attacker can execute script in the browser context of other GitLab users who view the crafted content, potentially stealing session data or acting as the victim within the application. The CVSS scope change indicates impact can extend beyond the vulnerable component.

Attack surface

Reached over the network through normal GitLab web interfaces where milestone references are rendered, such as issue descriptions and comments. The vector requires low privileges (an authenticated user able to create content) and user interaction from the victim who views it.

Exploitation

Not listed in CISA KEV and no public exploit tag appears in the references, though EPSS is very high at 0.87364 (99.7th percentile), suggesting elevated likelihood of exploitation activity. Reference tags are vendor advisory, broken link, and third-party advisory requiring permissions.

What to do

• Upgrade GitLab CE/EE to 14.7.7, 14.8.5, 14.9.2 or later as listed in the vendor advisory.
• If immediate upgrade is not possible, restrict who can create or edit issues and comments in sensitive projects.
• Review and sanitize existing issue descriptions and comments for injected milestone reference payloads.
• Apply GitLab's documented XSS hardening guidance and keep content security controls current.

Detection

• Search GitLab issue and comment content for unusual or malformed multi-word milestone reference patterns.
• Monitor web and application logs for script-like payloads in issue or comment creation requests.
• Review user reports of unexpected script execution or page behavior on issue and comment views.
• Audit accounts with low-privilege access that recently created or edited issue content.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.