What is the CVSS score of EUVD-2026-30234?

EUVD-2026-30234 has a CVSS 3.1 base score of 8.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of GitLab EE are affected by EUVD-2026-30234?

GitLab Enterprise Edition versions 18.7-18.11.x are vulnerable to stored cross-site scripting that allows authenticated users to inject malicious code into other users' sessions, with heightened risk…. A patch is available.

How to fix or mitigate EUVD-2026-30234?

Within 24 hours: Inventory all GitLab Enterprise Edition instances to identify which ones run versions 18.7-18.11.x. Within 7 days: Apply vendor patches to all affected systems, prioritizing those running version 18.11.x. Within 30 days: Perform post-deployment validation and scan user-editable fields to confirm no stored XSS payloads persist.

GitLab EE EUVD-2026-30234

| CVE-2026-6073 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-05-14 cve@gitlab.com

GHSA-7hxr-jf55-63c7

XSS Gitlab

8.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.7 HIGH

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 08:51 vuln.today

Patch available

May 14, 2026 - 07:16 EUVD

DescriptionCVE.org

GitLab has remediated an issue in GitLab EE affecting all versions from 18.7 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user to execute arbitrary JavaScript in other users' browsers due to improper input sanitization.

AnalysisAI

Stored cross-site scripting in GitLab Enterprise Edition 18.7-18.11.x allows an authenticated user to inject arbitrary JavaScript that executes in other users' browser sessions due to improper input sanitization. The CVSS 8.7 score is elevated by Scope:Changed (S:C), reflecting that injected script can pivot across security contexts and potentially target administrators. No public exploit identified at time of analysis, EPSS is very low (0.02%, 5th percentile), and SSVC indicates no observed exploitation, but a vendor patch is available across all three affected branches.

Technical ContextAI

The flaw is a CWE-79 (Improper Neutralization of Input During Web Page Generation) issue inside GitLab EE, the commercial distribution of the GitLab DevOps platform built on Ruby on Rails with a Vue.js front-end. CPE data (cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise) confirms only the Enterprise edition is in scope across the listed version branches. Cross-site scripting at this layer typically arises when user-controlled fields (issue titles, descriptions, comments, MR content, or similar Markdown/HTML-rendered surfaces) are rendered without sufficient escaping or content-security-policy enforcement, allowing attacker-controlled script to run under the victim's GitLab session origin.

RemediationAI

Vendor-released patches are available: upgrade GitLab EE to 18.9.7, 18.10.6, or 18.11.3 depending on which branch you run, per the May 13, 2026 patch release at https://about.gitlab.com/releases/2026/05/13/patch-release-gitlab-18-11-3-released/. There is no documented configuration workaround because the issue is a server-side sanitization bug; compensating controls until patching include tightening Content-Security-Policy headers on the GitLab instance (which may break some legitimate embedded content), restricting account self-registration so untrusted users cannot obtain the low-privilege account needed to plant the payload, and instructing administrators to avoid opening links/pages from untrusted projects since exploitation requires user interaction (UI:R). Track the underlying issue at https://gitlab.com/gitlab-org/gitlab/-/work_items/596340 and the HackerOne report at https://hackerone.com/reports/3655677 for further detail once disclosure closes.