EUVD-2026-42407
GHSA-7367-wp6r-gcqc
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Authenticated Developer account gives PR:L, victim must render the payload so UI:R, and stored XSS crossing into another user's session is S:C with high C/I and no availability impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
GitLab has remediated an issue in GitLab EE affecting all versions from 13.11 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to execute arbitrary scripts in another user's browser session due to improper sanitization of user-supplied input.
AnalysisAI
Stored/reflected cross-site scripting in GitLab Enterprise Edition lets an authenticated user holding Developer-role permissions inject arbitrary scripts that execute in a victim user's browser session, enabling session hijacking or actions performed as the victim. It affects a broad version range (13.11 through 18.11.6, 19.0.x before 19.0.4, and 19.1.x before 19.1.2) and stems from improper sanitization of user-supplied input. There is no public exploit identified at time of analysis, though the flaw was disclosed through a HackerOne bug-bounty report.
Technical ContextAI
The vulnerability is a CWE-79 (Improper Neutralization of Input During Web Page Generation) cross-site scripting flaw in GitLab EE, a self-managed and SaaS DevOps platform for source control, CI/CD, and project management. The root cause is that user-supplied input rendered into a web page is not properly sanitized/encoded, so attacker-controlled markup is interpreted as active HTML/JavaScript in another authenticated user's browser context. Because GitLab is a multi-tenant collaboration platform where lower-privileged roles (e.g., Developer) can author content that higher-privileged users view, an XSS payload stored in project artifacts (issues, merge requests, comments, or similar fields) crosses a trust boundary - reflected in the CVSS Scope:Changed metric. No CPE strings were supplied in the input, so exact affected configurations are taken from the vendor version ranges rather than NVD CPE data.
RemediationAI
Vendor-released patch: upgrade to GitLab EE 18.11.7, 19.0.4, or 19.1.2 (or later) depending on your current release branch, as documented in the GitLab patch release notes at https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-1-2-released/. Upgrading is the primary and recommended fix since the flaw is a server-side sanitization defect that cannot be fully mitigated at the client. Where an immediate upgrade is not possible, reduce exposure by tightening who holds Developer-role or higher permissions on sensitive projects and by limiting the assignment of untrusted accounts to roles that can author content viewed by others; note this constrains legitimate collaboration and does not eliminate the underlying XSS. A strict Content-Security-Policy at the reverse proxy can reduce script-execution impact as a defense-in-depth layer but may break GitLab UI functionality and is not a substitute for the patch. Track the internal fix via https://gitlab.com/gitlab-org/gitlab/-/work_items/597887.
An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. Rated critical severity (CVSS 10
An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.
The SSH key upload feature (lib/gitlab_keys.rb) in gitlab-shell before 1.7.3, as used in GitLab 5.0 before 5.4.1 and 6.x
A vulnerability in GitLab CE/EE affecting all versions from 11.10 prior to 15.1.6, 15.2 to 15.2.4, 15.3 to 15.3.2 allows
The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4
The Ruby SAML library is for implementing the client side of a SAML authorization. Rated critical severity (CVSS 9.8), t
A hardcoded password was set for accounts registered using an OmniAuth provider (e.g. Rated critical severity (CVSS 9.8)
An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.10 before 14.6.5, all versions star
When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab af
An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7.9 before 13.8.7, all versions sta
An issue was discovered in GitLab Omnibus 7.4 through 12.2.1. Rated critical severity (CVSS 9.8), this vulnerability is
An issue was discovered in GitLab Community and Enterprise Edition 9.x, 10.x, and 11.x before 11.5.8, 11.6.x before 11.6
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today