High-Severity GitLab XSS Flaw (CVE-2025-11224) Risks Kubernetes Proxy Session Hijacking

GitLab has released security updates for both Community Edition (CE) and Enterprise Edition (EE) addressing multiple vulnerabilities, including a high-severity cross-site scripting flaw tracked as CVE-2025-11224 that affects GitLab’s Kubernetes proxy feature.

According to GitLab, an authenticated user could execute stored XSS through improper input validation in the Kubernetes proxy functionality, potentially allowing malicious JavaScript to run for other users viewing the impacted component and risking sensitive data, authentication tokens, or administrator sessions. The flaw is listed with a CVSS score of 7.7 and is described as requiring only low-privilege access to exploit.

The updates say the issues affect all self-managed GitLab installations running vulnerable versions and should be patched promptly; a second flaw, CVE-2025-11865 (EE-exclusive, CVSS 6.5), could allow a user to delete Duo workflows belonging to another user. Fixes for these and other flaws were fully patched in versions 18.5.2, 18.4.4, and 18.3.6.