CVE-2025-9222
CVE-2025-9222: 2 tracked advisory records across GitLab, Red Hat. Compare vendor sources and published fix guidance.
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
Vendor advisory comparison
GitLab
1 advisory- Advisory severityHigh8.7
High [CVE-2025-9222] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
CVE-2025-9222Source published Source updated
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2.2 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed an authenticated user to achieve stored cross-site scripting by exploiting GitLab Flavored Markdown.
- Affected products in this advisory
- GitLab
- Source-reported affected versions
- GitLab 18.2.2 before 18.5.5
- GitLab 18.6 before 18.6.3
- GitLab 18.7 before 18.7.1
- Source-reported fixed versions
- 18.5.5
- 18.6.3
- 18.7.1
- Mitigation guidance
- No mitigation guidance extracted; consult the source.
Red Hat
1 advisory- Advisory severityHigh8.7
High [CVE-2025-9222] Stored Cross-Site Scripting via GitLab Flavored Markdown
CVE-2025-9222Source published
Stored Cross-Site Scripting via GitLab Flavored Markdown. Red Hat rates this important (CVSS 8.7). Weakness: CWE-79. No fix erratum has been published yet; monitor the Red Hat CVE page and apply the RHSA when released.
- Related products — impact not confirmed
- Red Hat Enterprise Linux
- Source-reported affected versions
- Affected-version details not available in this record.
- Source-reported fixed versions
- No fixed-version detail extracted. This does not mean no fix exists.
- Mitigation guidance
- Red Hat rates this important; a fix erratum may not be out yet — apply the RHSA as soon as it publishes.
Android app · Google Play
Turn CVE research into alerts on your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.