GitLab · disclosed reports
Cross-site Scripting
57 disclosed reports · $92,530 paid
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne.
Open GitLab on HackerOne- reports
- 57
- paid a bounty
- 19
Every one of the 57 is a mark on the map. Named now: 1 to 26, most upvoted first.
- Stored XSS in Wiki pages
- Stored XSS in markdown via the DesignReferenceFilter
- Stored XSS via Kroki diagram
- Stored-XSS with CSP-bypass via labels' color
- Stored XSS in Notes (with CSP bypass for gitlab.com)
- Persistent XSS in Note objects
- Stored XSS in custom emoji
- CSP-bypass XSS in project settings page
- Bypass: Stored-XSS with CSP-bypass via scoped labels' color
- XSS in request approvals
- New /add_contacts /remove_contacts quick commands susseptible to XSS from Customer Contact firstname/lastname fields
- Unrestricted file upload leads to Stored XSS
- Stored XSS in "Create Groups"
- XSS in ZenTao integration affecting self hosted instances without strict CSP
- Stored XSS in main page of a project caused by arbitrary script payload in group "Default initial branch name"
- Stored-XSS injected in Wiki page via Banzai pipeline
- Stored-XSS on wiki pages
- Stored XSS via Mermaid Prototype Pollution vulnerability
- Stored XSS in merge request pages
- Stored XSS on the job page
- Stored XSS in markdown when redacting references
- XSS on Issue reference numbers
- Stored XSS via Mermaid Prototype Pollution vulnerability
- XSS: `v-safe-html` is not safe enough
- Stored XSS in Mermaid when viewing Markdown files
- Stored XSS on issue comments and other pages which contain notes
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.