CVE-2025-9222
- Source
- https://cve.org/CVERecord?id=CVE-2025-9222
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-9222.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2025-9222
- Aliases
- Downstream
CGA (33)
- CGA-2v35-x745-jgx3
- CGA-2xr9-mx26-cpq5
- CGA-48h8-9r54-wgwx
- CGA-4wjh-xfqm-wrc4
- CGA-55vr-9vx6-926p
- CGA-58q6-2653-f67v
- CGA-629w-2p6v-w68v
- CGA-6mwm-9h33-9qh7
- CGA-6wrh-72m7-gg24
- CGA-744x-7c59-3xhm
- CGA-7c6m-g3gr-xfg9
- CGA-9285-wh47-4rq7
- CGA-9c52-fg6c-v7wm
- CGA-c77w-h563-wvc7
- CGA-g36h-6g33-f5x4
- CGA-g5w7-5595-xrpc
- CGA-g694-ph72-x949
- CGA-g8j9-c94r-5m6w
- CGA-gfx4-82rx-pw9h
- CGA-gvjf-4hhf-2h8f
- CGA-hjcx-766w-ggqh
- CGA-j7xr-8xvg-rcrm
- CGA-m9jj-2qr7-qpgp
- CGA-p992-xh4q-9884
- CGA-qqww-cq7f-cr8j
- CGA-rjxg-jjjv-7gwg
- CGA-v2rp-5xpf-275f
- CGA-vxhx-5949-v8vq
- CGA-w3qp-jx33-gh8q
- CGA-whrm-pfrp-hv67
- CGA-wqv7-9gfq-pcph
- CGA-x9cr-xvj5-v57h
- CGA-xvmq-7q38-4rqf
- Published
- 2026-01-09T10:04:36Z
- Modified
- 2026-10-22T02:48:46Z
- Severity
-
- 8.7 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N CVSS Calculator
- Summary
- Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
- Details
-
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2.2 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed an authenticated user to achieve stored cross-site scripting by exploiting GitLab Flavored Markdown.
- Database specific
{ "cna_assigner": "GitLab", "cwe_ids": [ "CWE-79" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/9xxx/CVE-2025-9222.json" }- References
-
- https://about.gitlab.com/releases/2026/01/07/patch-release-gitlab-18-7-1-released/
- https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-9222.json
- https://access.redhat.com/security/cve/CVE-2025-9222
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/9xxx/CVE-2025-9222.json
- https://nvd.nist.gov/vuln/detail/CVE-2025-9222
- https://bugzilla.redhat.com/show_bug.cgi?id=2428222
- https://gitlab.com/gitlab-org/gitlab/-/issues/562561
- https://hackerone.com/reports/3297483
- git://git@gitlab.com:gitlab-org/gitlab.git
Affected packages
Git / gitlab.com/gitlab-org/gitlab
Affected ranges
- Type
- GIT
- Repo
- https://gitlab.com/gitlab-org/gitlab
- Events
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "18.2.2" }, { "fixed": "18.5.5" } ], "source": "AFFECTED_FIELD", "strategy": "StandardRange" }, { "range": [ { "introduced": "18.6" }, { "fixed": "18.6.3" } ], "source": "AFFECTED_FIELD", "strategy": "StandardRange" }, { "range": [ { "introduced": "18.7" }, { "fixed": "18.7.1" } ], "source": "AFFECTED_FIELD", "strategy": "StandardRange" } ] }