CVE-2023-3500: GitLab

Medium severity, CVSS 6.1. EPSS: 0.5% chance of exploitation in the next 30 days.

An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.0 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. A reflected XSS was possible when creating specific PlantUML diagrams that allowed the attacker to perform arbitrary actions on behalf of victims.

Affected products

• GitLab GitLab: from 10.0, before 16.0.8 (fixed in 16.0.8); from 16.1, before 16.1.3 (fixed in 16.1.3); from 16.2, before 16.2.2 (fixed in 16.2.2)

Published 2023-08-02. Last modified 2026-06-17.