EUVD-2026-39181
GHSA-fc6w-qm7g-jfwh
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Network-reachable web app needing a low-privilege developer account (PR:L) and a victim viewing the content (UI:R); scope change (S:C) since script runs in another user's session, giving high C/I and no availability impact.
Primary rating from Vendor (gitlab).
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
GitLab has remediated an issue in GitLab EE affecting all versions from 16.4 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed an authenticated user with developer-role permissions to execute arbitrary client-side code in the context of another user's session, due to improper sanitization of user-supplied input.
Articles & Coverage 3
AnalysisAI
Stored cross-site scripting in GitLab Enterprise Edition (all versions from 16.4 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1) lets an authenticated user holding only developer-role permissions inject unsanitized input that executes as JavaScript in a victim's browser session. Because the script runs with scope change in the context of another (potentially higher-privileged) user, an attacker can hijack sessions, exfiltrate data, or act on the victim's behalf. The flaw was reported privately via HackerOne and patched by GitLab; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Technical ContextAI
This is a CWE-79 (improper neutralization of input during web page generation) cross-site scripting flaw in the GitLab EE web application. GitLab renders user-supplied content - fields in projects, issues, or merge requests that a developer-role member can edit - into pages viewed by other users; improper sanitization allows HTML/JavaScript to survive into the rendered DOM and execute. The CVSS scope change (S:C) reflects that the payload crosses a trust boundary: code authored by a low-privilege developer runs inside the browser session and security context of a different, possibly more privileged, GitLab user. The fix spanning the 18.11.x, 19.0.x, and 19.1.x branches indicates a shared rendering/sanitization code path affecting all releases back to 16.4.
RemediationAI
Upgrade to a fixed release - Vendor-released patch: 18.11.6, 19.0.3, or 19.1.1 (or any later version), per GitLab's advisory at https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-1-1-released/. Self-managed operators should apply the maintenance update for their branch immediately; GitLab.com SaaS is already patched. If an upgrade cannot be scheduled at once, reduce exposure by tightening who can obtain developer-role membership on sensitive projects and by restricting project membership and self-registration so untrusted users cannot author content that staff will view - note this constrains legitimate collaboration and does not eliminate the flaw. A strict Content-Security-Policy that disallows inline script can blunt many XSS payloads as defense-in-depth, but it is not a guaranteed substitute for the patch and may break custom integrations. No reliable configuration-only fix exists; patching is the only complete remediation.
An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. Rated critical severity (CVSS 10
An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.
Unauthenticated arbitrary file read in GitLab CE/EE lets remote attackers retrieve files from the GitLab server via the
The SSH key upload feature (lib/gitlab_keys.rb) in gitlab-shell before 1.7.3, as used in GitLab 5.0 before 5.4.1 and 6.x
A vulnerability in GitLab CE/EE affecting all versions from 11.10 prior to 15.1.6, 15.2 to 15.2.4, 15.3 to 15.3.2 allows
Sensitive credential and configuration disclosure in GitLab Enterprise Edition allows an authenticated user with Duo Cha
The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4
The Ruby SAML library is for implementing the client side of a SAML authorization. Rated critical severity (CVSS 9.8), t
A hardcoded password was set for accounts registered using an OmniAuth provider (e.g. Rated critical severity (CVSS 9.8)
An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.10 before 14.6.5, all versions star
When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab af
An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7.9 before 13.8.7, all versions sta
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today