CVE-2023-2164 in GitLab
Summary
by MITRE • 08/02/2023
An issue has been discovered in GitLab affecting all versions starting from 15.9 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. It was possible for an attacker to trigger a stored XSS vulnerability via user interaction with a crafted URL in the WebIDE beta.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/14/2026
The vulnerability identified as CVE-2023-2164 represents a critical stored cross-site scripting flaw within GitLab's WebIDE beta functionality. This security weakness affects multiple version ranges including all releases from 15.9 through 16.0.7, 16.1 through 16.1.2, and 16.2 through 16.2.1, creating an extensive attack surface for potential exploitation. The flaw specifically resides in how the WebIDE beta component processes user-supplied input when handling crafted URLs, making it particularly dangerous as it allows attackers to inject malicious scripts that persist within the application's environment.
The technical exploitation of this vulnerability occurs through a carefully crafted URL that, when interacted with by a victim, triggers a stored XSS payload within the WebIDE beta interface. This mechanism violates fundamental web security principles by allowing persistent script execution in the context of the victim's browser session. The vulnerability stems from inadequate input sanitization and output encoding within the WebIDE's URL handling routines, creating a pathway for attackers to inject malicious JavaScript code that gets stored and subsequently executed whenever legitimate users access the affected functionality. The CWE-79 classification applies directly to this issue as it represents a classic stored cross-site scripting vulnerability where malicious input is stored and later executed without proper sanitization.
From an operational impact perspective, this vulnerability presents significant risks to organizations utilizing GitLab's WebIDE beta features. Attackers could leverage this flaw to execute arbitrary code within users' browsers, potentially leading to session hijacking, credential theft, or data exfiltration from the GitLab environment. The stored nature of the vulnerability means that once exploited, the malicious payload persists and affects all subsequent users who interact with the compromised WebIDE functionality, creating a sustained threat vector. The attack requires only that a victim clicks on a maliciously crafted URL, making it particularly dangerous in collaborative development environments where team members frequently share links and resources within the GitLab platform.
The exploitation of CVE-2023-2164 aligns with several tactics outlined in the MITRE ATT&CK framework, specifically targeting the credential access and persistence phases through session manipulation and stored payload execution. Organizations using GitLab in production environments face potential compromise of source code repositories, user credentials, and sensitive development artifacts. The vulnerability's impact extends beyond immediate code execution to include potential lateral movement within the development ecosystem, as attackers could use the compromised WebIDE access to escalate privileges or access additional resources within the GitLab instance. Security teams should consider implementing immediate mitigations including disabling the WebIDE beta functionality, implementing strict input validation for URL parameters, and deploying web application firewalls to detect and block malicious URL patterns. The patching strategy should prioritize immediate upgrade to affected versions 16.0.8, 16.1.3, or 16.2.2 respectively, which contain the necessary fixes to address the input sanitization deficiencies in the WebIDE component.