EUVD-2026-57438
GHSA-qqh6-p6j8-qj74
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Network-delivered XSS requiring low-privilege auth (PR:L) and victim interaction (UI:R); scope change (S:C) reflects cross-user session compromise with no availability impact from script injection.
Primary rating from Vendor (GitLab).
CVSS VectorVendor: GitLab
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Lifecycle Timeline
3DescriptionCVE.org
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed cross-site scripting due to improper neutralization of user-controlled values rendered in table cell content by an analytics dashboard component.
Articles & Coverage 2
AnalysisAI
Stored cross-site scripting in GitLab CE/EE's analytics dashboard component allows an authenticated low-privilege user to inject malicious JavaScript into table cell content that executes in the browsers of other users who view the affected dashboard. The scope change (S:C in CVSS) confirms the impact crosses security boundaries, enabling session hijacking, credential theft, or unauthorized API actions on behalf of victims including administrators. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must hold a valid GitLab account with at least low-level project access (PR:L) sufficient to write content that is later rendered in the analytics dashboard table cell context - the specific field or input vector is not detailed in available data beyond 'user-controlled values rendered in table cell content by an analytics dashboard component.' The victim must actively navigate to and view the affected analytics dashboard (UI:R), meaning passive background processes are not sufficient to trigger execution. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.7 score reflects genuine high risk: the network attack vector (AV:N) and low complexity (AC:L) mean the attack is straightforward once the attacker has any authenticated foothold. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with a low-privilege GitLab account (e.g., Reporter or Developer role) crafts a malicious payload targeting a field rendered as table cell content in the analytics dashboard - such as a project label, metric name, or custom value - embedding a JavaScript payload that exfiltrates the victim's session cookie or GitLab personal access token. When a project maintainer or administrator opens the analytics dashboard, their browser executes the payload and silently transmits their credentials to an attacker-controlled endpoint. … |
| Remediation | Upgrade to one of the fixed releases: GitLab 19.0.6, 19.1.4, or 19.2.2, per the vendor patch release advisory at https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-2-released/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all GitLab CE/EE instances and restrict analytics dashboard access to essential users only while enabling detailed access logging. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. Rated critical severity (CVSS 10
An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.
The SSH key upload feature (lib/gitlab_keys.rb) in gitlab-shell before 1.7.3, as used in GitLab 5.0 before 5.4.1 and 6.x
A vulnerability in GitLab CE/EE affecting all versions from 11.10 prior to 15.1.6, 15.2 to 15.2.4, 15.3 to 15.3.2 allows
The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4
The Ruby SAML library is for implementing the client side of a SAML authorization. Rated critical severity (CVSS 9.8), t
A hardcoded password was set for accounts registered using an OmniAuth provider (e.g. Rated critical severity (CVSS 9.8)
An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.10 before 14.6.5, all versions star
When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab af
An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7.9 before 13.8.7, all versions sta
An issue was discovered in GitLab Omnibus 7.4 through 12.2.1. Rated critical severity (CVSS 9.8), this vulnerability is
An issue was discovered in GitLab Community and Enterprise Edition 9.x, 10.x, and 11.x before 11.5.8, 11.6.x before 11.6
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today