GitLab · disclosed reports
Cross-site Scripting
30 disclosed reports · $77,400 paid · 30 valid
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. A report opens its page here: our analysis where there is one, and the link to HackerOne. The status is HackerOne's own outcome; "access needed" is only what a title states.
Open GitLab on HackerOne- reports
- 30
- valid
- 30
- paid a bounty
- 13
Every one of the 30 is a mark on the map. Named now: 1 to 26, most upvoted first.
- Stored XSS in Wiki pages
- Stored XSS in markdown via the DesignReferenceFilter
- Stored XSS via Kroki diagram
- Stored-XSS with CSP-bypass via labels' color
- Stored XSS in Notes (with CSP bypass for gitlab.com)
- Persistent XSS in Note objects
- Stored XSS in custom emoji
- CSP-bypass XSS in project settings page
- Bypass: Stored-XSS with CSP-bypass via scoped labels' color
- XSS in request approvals
- New /add_contacts /remove_contacts quick commands susseptible to XSS from Customer Contact firstname/lastname fields
- Unrestricted file upload leads to Stored XSS
- Stored XSS in "Create Groups"
- XSS in ZenTao integration affecting self hosted instances without strict CSP
- Stored XSS in main page of a project caused by arbitrary script payload in group "Default initial branch name"
- Stored-XSS injected in Wiki page via Banzai pipeline
- Stored-XSS on wiki pages
- Stored XSS via Mermaid Prototype Pollution vulnerability
- Stored XSS in merge request pages
- Stored XSS on the job page
- Stored XSS in markdown when redacting references
- XSS on Issue reference numbers
- Stored XSS via Mermaid Prototype Pollution vulnerability
- XSS: `v-safe-html` is not safe enough
- Stored XSS in Mermaid when viewing Markdown files
- Stored XSS on issue comments and other pages which contain notes
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.