CVE-2022-1175

HIGH

GitLab 14.4-14.6.7 14.8-14.8.4 14.9-14.9.1 - Stored Cross-Site Scripting via Notes

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2022-1175. PoCs published by Greenwolf.

AI-analyzed exploit summary This exploit demonstrates a Stored XSS vulnerability in GitLab, allowing an attacker to inject malicious scripts via project issues. The payload manipulates the base href or directly includes a remote script, bypassing CSP under certain conditions.

Description

Improper neutralization of user input in GitLab CE/EE versions 14.4 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versions starting from 14.9 before 14.9.2 allowed an attacker to exploit XSS by injecting HTML in notes.

Exploits (2)

exploitdb WORKING POC
by Greenwolf · textwebappsruby
https://www.exploit-db.com/exploits/50889

This exploit demonstrates a Stored XSS vulnerability in GitLab, allowing an attacker to inject malicious scripts via project issues. The payload manipulates the base href or directly includes a remote script, bypassing CSP under certain conditions.

Classification
Working Poc 90%
Attack Type
Xss
Complexity
Trivial
Reliability
Reliable
Target: GitLab CE/EE (versions 14.4 before 14.7.7, 14.8 before 14.8.5, 14.9 before 14.9.2)
Auth required
Prerequisites: Valid GitLab user account · Ability to create or edit project issues
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC 1 stars
by Greenwolf · poc
https://github.com/Greenwolf/CVE-2022-1175

This repository provides a proof-of-concept for CVE-2022-1175, a stored XSS vulnerability in GitLab. The exploit allows an attacker to inject malicious scripts into an issue, potentially leading to the theft of Personal Access Tokens (PAT) and full account takeover.

Classification
Working Poc 90%
Attack Type
Xss
Complexity
Trivial
Reliability
Reliable
Target: GitLab (versions prior to 14.9.2)
Auth required
Prerequisites: Access to create or edit an issue in a GitLab project
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (4)

Core 4
Core References
Permissions Required, Third Party Advisory x_refsource_misc
https://hackerone.com/reports/1481207

Scores

CVSS v3 8.7
EPSS 0.8304
EPSS Percentile 99.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Details

CWE
CWE-79
Status published
Products (1)
gitlab/gitlab 14.4.0 - 14.7.7 (2 CPE variants)
Published Apr 04, 2022
Tracked Since Feb 18, 2026