What is the CVSS score of CVE-2026-6335?

CVE-2026-6335 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-6335?

Yes, a patch is available for CVE-2026-6335. Update the affected software to the latest version immediately.

GitLab CVE-2026-6335

EUVD-2026-30235 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-14 cve@gitlab.com

GHSA-3jrg-257v-4fw6

XSS Gitlab RCE

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 11:19 vuln.today

Patch available

May 14, 2026 - 07:16 EUVD

DescriptionCVE.org

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.11 before 18.11.3 that under certain conditions could have allowed an authenticated user to execute arbitrary code in another user's browser session due to improper sanitization.

AnalysisAI

Cross-site scripting in GitLab CE/EE 18.11.x (before 18.11.3) enables an authenticated low-privilege attacker to inject unsanitized content that executes arbitrary JavaScript within another user's browser session. The CVSS Scope Changed (S:C) flag reflects the cross-user impact boundary: the vulnerability allows one GitLab principal to affect a distinct security context belonging to a different user, including potentially higher-privileged accounts such as project owners or instance administrators. No public exploit code exists and no active exploitation has been identified - EPSS at 0.02% (5th percentile) and SSVC exploitation status of 'none' both confirm low immediate urgency - though GitLab's wide enterprise deployment makes patching to 18.11.3 advisable.

Technical ContextAI

CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting) describes a failure to neutralize user-controlled data before it is rendered in a web context, allowing injection of executable script markup. Both GitLab Community Edition and Enterprise Edition are confirmed affected per CPE strings cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:* and cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*, scoped to the 18.11 branch. The CVSS Scope Changed (S:C) value is mechanistically consistent with stored or reflected XSS: the attacker's injected payload executes inside the victim's browser context - a different security principal than the GitLab application server - which crosses an implicit trust boundary. The specific input field or feature carrying the injection vector is not publicly disclosed, with the underlying HackerOne report (3673647) likely under partial embargo.

RemediationAI

Upgrade all GitLab CE/EE 18.11.x installations to version 18.11.3, the vendor-released patch documented at https://about.gitlab.com/releases/2026/05/13/patch-release-gitlab-18-11-3-released/. This is the primary and preferred remediation; no workaround fully substitutes for patching. If upgrade cannot be performed immediately, deploying or tightening a Content Security Policy (CSP) header on the GitLab instance to restrict JavaScript execution to approved origins can reduce the blast radius of successful XSS injection - however, GitLab's rich UI depends on inline scripts and this may cause feature breakage requiring testing. Additionally, restricting GitLab project membership to vetted, trusted accounts (e.g., limiting Reporter/Developer roles on sensitive projects) reduces the attacker pool, at the cost of collaboration openness. Monitoring GitLab audit logs for anomalous cross-user actions or unexpected session activity can provide detection coverage while the patch is staged.