CVE-2025-9222

MediumCVSS 5.4/10Last modified Jul 15, 2026

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2.2 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed an authenticated user to achieve stored cross-site scripting by exploiting GitLab Flavored Markdown.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
GitLab	GitLab	>= 18.2.2, < 18.5.5; >= 18.6, < 18.6.3; >= 18.7, < 18.7.1
Red Hat	OpenShift Pipelines	—
Red Hat	Red Hat OpenShift Container Platform 4	—
Red Hat	Red Hat OpenShift Container Platform 4	—

References

https://about.gitlab.com/releases/2026/01/07/patch-release-gitlab-18-7-1-released/Release Notes, Vendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/562561Broken Link
https://hackerone.com/reports/3297483Permissions Required
https://access.redhat.com/security/cve/CVE-2025-9222
https://bugzilla.redhat.com/show_bug.cgi?id=2428222
https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-9222.json

Timeline

Published: Jan 9, 2026
Last modified: Jul 15, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-92238.8Zohocorp ManageEngine Applications Manager versions 178100 and below are vulnerable to authenticated command injection vulnerability due to CVE-2025-92255.5Stored cross-site scripting (XSS) in the web interface of MiR software versions prior to 3.0.0 on MiR Robots and MiR Fleet allows execution CVE-2025-92264.6Zohocorp ManageEngine OpManager, NetFlow Analyzer, and OpUtils versions prior to 128582 are affected by a stored cross-site scripting vulner CVE-2025-92276.5Zohocorp ManageEngine OpManager versions 128609 and below are vulnerable to Stored XSS Vulnerability in the SNMP trap processor.CVE-2025-92284.3MiR software versions prior to version 3.0.0 have insufficient authorization controls when creating text notes, allowing low-privilege user CVE-2025-92295.3Information disclosure vulnerability in error handling in MiR software prior to version 3.0.0 allows unauthenticated attackers to view detai CVE-2025-92309.8Issue summary: An application trying to decrypt CMS messages encrypted using password based encryption can trigger an out-of-bounds read and CVE-2025-92315.9Issue summary: A timing side-channel which could potentially allow remote recovery of the private key exists in the SM2 algorithm implementa CVE-2025-92325.9Issue summary: An application using the OpenSSL HTTP client API functions may trigger an out-of-bounds read if the 'no_proxy' environment va CVE-2025-92335.4A security vulnerability has been detected in Scada-LTS up to 2.7.8.1. Impacted is an unknown function of the file view_edit.shtm. The manip CVE-2025-92345.4A vulnerability was detected in Scada-LTS up to 2.7.8.1. The affected element is an unknown function of the file maintenance_events.shtm. Th CVE-2025-92355.4A flaw has been found in Scada-LTS up to 2.7.8.1. The impacted element is an unknown function of the file compound_events.shtm. This manipul