CVE-2023-2442: GitLab CE/EE stored XSS via crafted merge request

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityThe flaw is a stored XSS with a very high EPSS score and a low-privilege, user-interaction-dependent path, though it is not in KEV and requires a victim to view the crafted merge request.

What it is

GitLab CE/EE versions from 15.11 before 15.11.7 and from 16.0 before 16.0.2 contain a stored cross-site scripting flaw reachable through a specially crafted merge request. Because the injected script persists and executes in a victim's browser session, it can be used to act as that user, which matters for any team running an affected self-managed or GitLab.com-hosted instance.

Impact

An attacker can execute arbitrary script in the context of a victim's GitLab session, performing actions on the victim's behalf within the application. The CVSS scope change (S:C) reflects that the compromise can extend beyond the vulnerable component.

Attack surface

Reached over the network through the merge request workflow; the CVSS vector requires low privileges (PR:L) and user interaction (UI:R), meaning an authenticated attacker with merge request access must get a victim to view the crafted content.

Exploitation

Not listed in CISA KEV and no public exploit tag appears in the references, but EPSS is very high (0.96058, 99.874th percentile), indicating elevated predicted exploitation activity. The HackerOne report is tagged Permissions Required, consistent with the low-privilege precondition.

What to do

• Upgrade GitLab CE/EE to 15.11.7 or later in the 15.11 line, or 16.0.2 or later in the 16.0 line; apply the vendor advisory patch first.
• If immediate upgrade is not possible, restrict merge request creation and review permissions to trusted users and monitor for suspicious MR content.
• Enforce a strict Content Security Policy and keep GitLab's built-in XSS protections enabled to reduce script execution impact.
• Review and sanitize any custom integrations or templates that render merge request content outside GitLab's normal UI.
• Track the vendor advisory and HackerOne report for updated affected-version details before closing the exposure.

Detection

• Search GitLab application and reverse-proxy logs for merge request descriptions or comments containing script tags, event handlers, or javascript: URIs.
• Monitor for anomalous authenticated actions (settings changes, token creation, project modifications) originating from sessions that recently viewed merge requests.
• Alert on unexpected outbound requests or browser-side activity tied to GitLab users following merge request review.
• Correlate GitLab audit events with user reports of unexpected behavior after opening a merge request.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.