CVE-2023-0050

Deeper analysis

CVE-2023-0050 is a stored cross-site scripting vulnerability in GitLab, present in all versions from 13.7 through 15.7.7, 15.8 through 15.8.3, and 15.9 through 15.9.1. The flaw resides in the handling of Kroki diagrams, where a specially crafted diagram can be stored and later rendered to execute arbitrary script in a victim's browser session.

An authenticated attacker with permission to create or edit content containing Kroki diagrams can upload a malicious payload that persists in the application. When another user views the affected page, the script executes in the victim's context, enabling actions such as account takeover or unauthorized data access on their behalf. The CVSS 8.7 score reflects network attack vector, low complexity, and the requirement for some user interaction combined with changed scope.

GitLab advisories and the associated issue tracker entries direct administrators to upgrade to the fixed releases 15.7.8, 15.8.4, or 15.9.2, which sanitize Kroki diagram input before storage and rendering. No additional configuration changes are specified beyond applying the patches.

The EPSS score rose from a low baseline after disclosure to a peak of 0.7828 in December 2025 before receding to the current value of 0.5651, indicating that exploitation interest increased well after the initial publication.