GitLab Patch: High-Severity XSS & AI Flaws Expose User Data

GitLab has issued a critical security release for its Community Edition and Enterprise Edition platforms, patching a raft of vulnerabilities that range from high-severity XSS to unauthorized AI model access, with updates available immediately for versions 18.7.1, 18.6.3 and 18.5.5.

According to GitLab, three high-severity flaws could compromise user accounts and sensitive data, including Stored XSS in Markdown (CVE-2025-9222) with a CVSS of 8.7, Web IDE XSS (CVE-2025-13761) scored 8.0, and a Duo Workflows API Authorization Bypass (CVE-2025-13772) rated 7.1. The release also covers several medium-severity issues, such as an AI GraphQL Mutation (CVE-2025-13781) and Import DoS (CVE-2025-10569), among others, with further details linked in CVE-WATCHTOWER.

Administrators are urged to upgrade to 18.7.1, 18.6.3, or 18.5.5 to secure pipelines, as some affected versions extend back to 10.3 due to the Mermaid diagram rendering leak (CVE-2025-3950). The article references the patch release published on 7 January 2026 and highlights the potential impact on authenticated users and unauthenticated visitors who engage with crafted content or pages.