CVE-2023-0050: GitLab Kroki diagram stored XSS enables actions as victims

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityStored XSS in an authenticated collaboration platform with a very high EPSS score and scope change can lead to account compromise, though it requires low privileges and user interaction.

What it is

GitLab fails to properly sanitize specially crafted Kroki diagrams, allowing stored cross-site scripting. The flaw affects all versions from 13.7 before 15.7.8, from 15.8 before 15.8.4, and from 15.9 before 15.9.2. Because the payload is stored, it can execute in the browser of any user who views the affected diagram.

Impact

An attacker can run arbitrary script in a victim's authenticated GitLab session, performing actions on the victim's behalf. The CVSS scope change (S:C) reflects that the impact can extend beyond the vulnerable component.

Attack surface

Reached over the network through a crafted Kroki diagram rendered in GitLab; the vector requires low privileges (PR:L) and user interaction (UI:R), meaning the victim must view the malicious diagram.

Exploitation

Not listed in CISA KEV and no public exploit reference is tagged; EPSS is very high at 0.9242 (99.8th percentile), indicating elevated predicted exploitation activity, though the record does not confirm active exploitation.

What to do

• Upgrade GitLab to 15.7.8, 15.8.4, or 15.9.2 (or later) as applicable to your release line.
• If immediate patching is not possible, restrict or disable Kroki diagram rendering until the upgrade is complete.
• Limit who can create or edit content containing diagrams to reduce the pool of users who can plant a stored payload.
• Review and remove any existing Kroki diagrams from untrusted contributors as part of remediation.

Detection

• Search GitLab content and database records for Kroki diagram blocks containing script tags or unusual HTML/JavaScript payloads.
• Monitor GitLab application and web logs for requests or rendered content matching known Kroki XSS patterns.
• Review user activity for unexpected actions performed shortly after viewing diagrams, especially by privileged accounts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.