What is the CVSS score of EUVD-2026-30238?

EUVD-2026-30238 has a CVSS 3.1 base score of 8.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of GitLab EE are affected by EUVD-2026-30238?

GitLab Enterprise Edition versions 18.7 through 18.11.2 contain a stored cross-site scripting vulnerability in customizable analytics dashboards that permits injection of malicious JavaScript for…. A patch is available.

How to fix or mitigate EUVD-2026-30238?

Within 24 hours: Identify all GitLab EE deployments and confirm whether they run versions 18.7-18.9.6, 18.10-18.10.5, or 18.11-18.11.2. Within 7 days: Apply vendor-released patch to all affected instances. Within 30 days: Audit analytics dashboard modification logs for suspicious activity during exposure window, validate patch deployment across all instances, and confirm dashboard functionality restoration.

GitLab EE EUVD-2026-30238

| CVE-2026-7377 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-05-14 cve@gitlab.com

GHSA-cv3h-4g8c-4vw6

XSS Gitlab

8.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.7 HIGH

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 09:12 vuln.today

Patch available

May 14, 2026 - 07:16 EUVD

DescriptionCVE.org

GitLab has remediated an issue in GitLab EE affecting all versions from 18.7 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that, in customizable analytics dashboards, could have allowed an authenticated user to execute arbitrary JavaScript in the context of other users' browsers due to improper input sanitization.

AnalysisAI

Stored cross-site scripting in GitLab Enterprise Edition's customizable analytics dashboards allows an authenticated user to execute arbitrary JavaScript in the browsers of other users who view the affected dashboard. The flaw affects EE 18.7-18.9.6, 18.10-18.10.5, and 18.11-18.11.2, carries a CVSS 8.7 (scope-changed) rating, and a vendor patch is available. No public exploit identified at time of analysis and EPSS is very low (0.02%, 5th percentile).

Technical ContextAI

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically improper input sanitization in the customizable analytics dashboard component of GitLab Enterprise Edition. Dashboard configuration values supplied by an authenticated user are rendered into other users' DOM context without being safely encoded, enabling injected script to run with the victim's session privileges. CPE data confirms the affected product set is restricted to the GitLab Enterprise edition (cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*), not Community Edition. The scope-changed CVSS vector (S:C) reflects that the injected script crosses a security boundary into the victim's authenticated session, where it can read tokens, exfiltrate data, or perform actions on behalf of the victim - including potentially privileged users such as maintainers or admins.

RemediationAI

Vendor-released patch: upgrade GitLab EE to 18.9.7, 18.10.6, or 18.11.3 (matching your current release train) as documented in the GitLab patch release notes at https://about.gitlab.com/releases/2026/05/13/patch-release-gitlab-18-11-3-released/. If immediate patching is not possible, restrict who can create or edit customizable analytics dashboards by tightening project/group role assignments so that only trusted maintainers retain dashboard authoring rights - this reduces the population of potential attackers but does not eliminate risk if any authoring role is shared with untrusted users. As an additional defense, ensure a strong Content Security Policy is enforced on the GitLab web origin to limit the impact of injected script, accepting the trade-off that custom CSP tuning can break some GitLab integrations and must be tested. Audit recent dashboard configuration changes after patching for any payloads that may already have been planted, since the issue is exploited via stored input.