CVE-2024-4201

A cross-site scripting issue has been discovered in GitLab affecting all versions starting from 5.1 before 16.10.7, all versions starting from 16.11 before 16.111.4, all versions starting from 17.0 before 17.0.2. When viewing an XML file in a repository in raw mode, it can be made to render as HTML if viewed under specific circumstances.

• CWE-79
• CWE-79

• https://about.gitlab.com/releases/2024/06/12/patch-release-gitlab-17-0-2-released/#xss-and-content-injection-when-viewing-raw-xhtml-files-on-ios-devicesRelease Notes
• https://gitlab.com/gitlab-org/gitlab/-/issues/458229Vendor Advisory
• https://hackerone.com/reports/2473886Third Party Advisory
• https://about.gitlab.com/releases/2024/06/12/patch-release-gitlab-17-0-2-released/#xss-and-content-injection-when-viewing-raw-xhtml-files-on-ios-devicesRelease Notes
• https://gitlab.com/gitlab-org/gitlab/-/issues/458229Vendor Advisory
• https://hackerone.com/reports/2473886Third Party Advisory

Published

Jun 12, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-42004A library injection vulnerability exists in Microsoft Teams …9.8
• CVE-2024-42005An issue was discovered in Django 5.0 before 5.0.8 and 4.2 b…7.3
• CVE-2024-42006Keyfactor AWS Orchestrator through 2.0 allows Information Di…7.5
• CVE-2024-42007SPX (aka php-spx) through 0.4.15 allows SPX_UI_URI Directory…5.8
• CVE-2024-42008A Cross-Site Scripting vulnerability in rcmail_action_mail_g…9.3
• CVE-2024-42009A Cross-Site Scripting vulnerability in Roundcube through 1.…9.3
• CVE-2024-42010mod_css_styles in Roundcube through 1.5.7 and 1.6.x through …7.5
• CVE-2024-42011The Spotify app 8.9.58 for iOS has a buffer overflow in its …7.5
• CVE-2024-42012GRAU DATA Blocky before 3.1 stores passwords encrypted rathe…5.7
• CVE-2024-42013In GRAU DATA Blocky before 3.1, Blocky-Gui has a Client-Side…6.4
• CVE-2024-42017An issue was discovered in Atos Eviden iCare 2.7.1 through 2…10
• CVE-2024-42018An issue was discovered in Atos Eviden SMC xScale before 1.6…7.7