CVE-2024-4901

CVE-2024-4901 is a stored Cross-Site Scripting (XSS) vulnerability affecting GitLab CE/EE versions 16.9 through 17.1.1. This flaw allows an attacker to inject malicious code into commit notes within a project, which can then execute when viewed by other users. Rated Medium severity (CVSS 5.4), the vulnerability requires low privileges and user interaction (viewing the malicious commit notes) to achieve limited confidentiality and integrity impacts. The attack vector is over the network. While there is no evidence of active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered significant community discussion and media coverage, indicating heightened awareness. Organizations should prioritize patching to mitigate this risk.