HTML and JavaScript Injection Vulnerability in GitLab CE/EE
CVE-2025-12669

5.4MEDIUM

Key Information:

Vendor

Gitlab
Status
Gitlab
Vendor
CVE Published:
14 May 2026

What is CVE-2025-12669?

A vulnerability in GitLab CE/EE allows authenticated users to exploit improper input sanitization, potentially injecting HTML and JavaScript into email notifications sent to other users. This can result in malicious content being displayed in the notifications, which could further compromise user security or lead to phishing attacks.

Affected Version(s)

GitLab 15.11 < 18.9.7

GitLab 18.10 < 18.10.6

GitLab 18.11 < 18.11.3

References

https://hackerone.com/reports/3368096
technical-descriptionexploitpermissions-required
https://gitlab.com/gitlab-org/gitlab/-/work_items/579385
https://about.gitlab.com/releases/2026/05/13/patch-releas...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Thanks [ricardobrito](https://hackerone.com/ricardobrito) for reporting this vulnerability through our HackerOne bug bounty program
.