CVE-2022-3265: GitLab label colour stored XSS enables client-side actions

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

medium priorityCVSS 3.1 base score is 5.4 (Medium) with required privileges and user interaction, though EPSS is very high and the flaw is stored XSS in a widely deployed product.

What it is

GitLab CE/EE contains a stored cross-site scripting flaw in the label colour setting feature, affecting versions before 15.3.5, 15.4.4, and 15.5.2. An attacker who can set a label colour can inject script that executes in a victim's browser session. Because the payload is stored, it can fire for any user who views the affected label.

Impact

An attacker can run arbitrary JavaScript in a victim's GitLab session, performing actions on the victim's behalf at client side. The CVSS scope change (S:C) indicates impact can extend beyond the vulnerable component.

Attack surface

Reached over the network through the GitLab web interface; the vector requires low privileges (PR:L) and user interaction (UI:R), meaning an authenticated user with label permissions must set the malicious colour and a victim must view the affected label.

Exploitation

Not listed in CISA KEV and no ransomware association is documented. EPSS is high (0.86326, 99.7th percentile), but the references only include vendor advisory, a broken issue link, and a HackerOne report requiring permissions, so no public exploit code is confirmed.

What to do

• Upgrade GitLab CE/EE to 15.3.5, 15.4.4, or 15.5.2 or later.
• Restrict label creation and colour editing to trusted users until patched.
• Review existing label colours for injected markup and remove suspicious values.
• Apply GitLab's vendor advisory guidance for this CVE.

Detection

• Search GitLab logs and audit events for label colour changes containing script or HTML markup.
• Inspect stored label colour values in the database for unexpected characters.
• Monitor for anomalous authenticated actions consistent with session hijacking or CSRF-style abuse.
• Review HackerOne report 1693150 for reproduction details if access is available.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.