CVE-2025-67202: commercial-gitlab-rails-ee-19.1 Cross-site Scripting
CVSS: 6.1v3.1MediumAwaiting analysis
AliasesCGA-2cpv-h99w-p9gmCGA-2grp-ch86-v6rqCGA-2jp6-xm88-rpfmCGA-3c37-f5qj-g537CGA-3g37-69mq-hj54CGA-3rfc-65f6-w9x5CGA-3vx5-x9j5-h4fgCGA-4883-2v9w-g5fxCGA-4p53-mpvw-gx92CGA-4p97-xhrg-4m4fCGA-567h-h5fw-hpmxCGA-578r-69hj-3vr8CGA-636p-9xm2-x27rCGA-64m9-wcpm-mrqpCGA-6g8m-8wqj-f9qfCGA-7266-gqhw-mwrmCGA-7c34-mmw9-fxxvCGA-7ggf-7vcj-j2hpCGA-8476-hvjf-378rCGA-84q5-h9j8-x6c7CGA-87xv-27g4-v3f2CGA-8j2x-7vvc-53vwCGA-8pvp-cr34-wfq5CGA-8r4p-344h-m2x2CGA-92f8-g439-fv7wCGA-9qxm-v8m2-mm96CGA-c88p-vfjm-r6gcCGA-cwfj-43vc-rr5wCGA-f8hp-rx6x-83q2CGA-fj3g-6hmh-6784CGA-fmr7-gj8q-mqrxCGA-g56p-824q-hhjxCGA-g5f7-xr34-j3x2CGA-gpqw-9w46-r9g4CGA-gr5j-6j4f-5qxqCGA-h63w-g7v7-h464CGA-hcw8-8g7p-5479CGA-j42p-97h3-fxmrCGA-j57g-6j8p-cpmwCGA-j5f9-wxwq-pxwxCGA-jj28-mxvj-pg49CGA-jjgw-vvcm-pw2gCGA-jmpx-wg68-m532CGA-jvmm-3qx7-rh3jCGA-m3wx-8gr9-qq26CGA-mh7f-6428-ppf7CGA-mmq4-x7ch-3mv2CGA-mmr3-5ph9-x5m5CGA-p299-926m-36hmCGA-p5x6-vwwh-jpqqCGA-p85p-7vpx-vwcjCGA-ppv3-8h56-vcvqGHSA-xv9c-mjw8-79gfCGA-q865-rm5j-3j96CGA-qx32-8qr4-jjjxCGA-qx69-8mrx-wgr8CGA-rjfh-xrq7-5j9vCGA-rxqx-75g2-rj3wCGA-v2wq-q8hf-f72pCGA-v3x7-wpvw-w8wmCGA-v47w-6wcq-jmq8CGA-vhvf-9jcr-v259CGA-vw8q-f528-whpwCGA-w74r-3f9v-9824CGA-w757-f57f-h84qCGA-wff8-93h8-jg3cCGA-wmjp-jrh9-jf99CGA-wmx5-26c3-rxjgCGA-wvpg-7423-v5cfCGA-x2qp-9r27-xhp7CGA-x4x9-v495-v354CGA-x6cf-5wrq-fj5cCGA-x883-rr5m-vvqcCGA-xc3h-6ccg-qxh4CGA-xm8j-p76p-57v2CGA-xq47-fjvq-9gxrCGA-xwm6-w6vv-44cw
Published 07-05-2026Last modified 08-05-2026
Vulnerability summary
CVE-2025-67202 is a medium (CVSS 6.1) Cross-site Scripting vulnerability in commercial-gitlab-rails-ee-19.1. EPSS estimates a 0.19% chance of exploitation in the next 30 days, higher than 8.5% of scored vulnerabilities.
CVSS score
6.1/10
010
Medium · v3.1 (CVE.org)EPSS score
0.19%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 07-05-2026PublishedVulnerability first disclosed.
- 08-05-2026Last modifiedVulnerability information updated.
Description
Sidekiq-cron thru 2.3.1, an open-source scheduling add-on for Sidekiq, is vulnerable to a cross-site scripting (xss) vulnerability via crafted URL being rended from cron.erb.
CVSS metrics
4 scores · 4 sources · 1 versionMedium 6.1Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NSourcesAll 4 agree
- OSV · ChainguardEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- OSV · RubygemsEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- NVDNIST6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS trend
Probability
0.19%
Chance of exploitation in the next 30 days
Percentile
9%
Versus all other CVEs
30-day change
0.00 pp
From 0.19% on 20-09-2026
20-09-202620-10-2026
EPSS score0.19%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard38 products
- commercial-gitlab-rails-ee-19.1All versions (No fix recorded)
- commercial-gitlab-rails-ee-19.2< 19.2.7-r4
- commercial-gitlab-rails-ee-19.3< 19.3.3-r4
- commercial-gitlab-rails-ee-19.4< 19.4.1-r3
- commercial-gitlab-rails-ee-fips-19.1All versions (No fix recorded)
RubyGems1 product
- sidekiq-cron< 2.4.0
2 vendors · 39 products
