GitLab: unsanitized HTML in the CI job modal lets a developer-role user escalate privileges

Impact

HTML rendered in the CI job modal is not sanitized properly, so a user holding only the developer role can plant content that executes in the session of whoever opens that modal. The CVSS vector is scope-changed with high confidentiality, integrity, and availability, meaning the attacker can end up acting as a higher-privileged account. On a self-hosted GitLab driving a GPU fleet, that account controls pipeline definitions, runner registration tokens, and the credentials CI jobs use — the route from a developer-level foothold to controlling what executes on the GPU nodes. Exploitation needs a victim to view the affected modal, so it is not unattended. Affected: 19.2 before 19.2.2.

Who can reach it

An authenticated user with developer-role permissions on a project, plus a more privileged user who opens the CI job modal for the poisoned job.

What to do

Upgrade to GitLab 19.2.2. Control-plane package upgrade and service restart; brief GitLab outage, no effect on nodes already running jobs.

References