What is the CVSS score of EUVD-2026-36223?

EUVD-2026-36223 has a CVSS 3.1 base score of 8.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of GitLab EE are affected by EUVD-2026-36223?

GitLab Enterprise Edition Analytics Dashboard contains a stored cross-site scripting vulnerability (CVE-2026-10087, CVSS 8.7) affecting versions 17.1 through 19.0.x that allows authenticated…. A patch is available.

Is there a public PoC exploit available for EUVD-2026-36223?

Yes, a public proof-of-concept exploit is available for EUVD-2026-36223. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate EUVD-2026-36223?

Within 24 hours: Inventory all GitLab EE instances running versions 17.1-19.0.x; restrict Analytics Dashboard access to trusted administrative accounts; enable audit logging on dashboard interactions. Within 7 days: Test upgrade path to confirmed patched GitLab version (when released by vendor); identify critical instances requiring immediate isolation. Within 30 days: Complete upgrade to patched release or implement permanent compensating controls for all affected instances.

GitLab EE EUVD-2026-36223

| CVE-2026-10087 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-06-11 GitLab

GHSA-vcvx-j5vc-8jhr

Gitlab XSS

8.7

CVSS 3.1 · Vendor: GitLab

Severity by source

Vendor (GitLab) PRIMARY

8.7 HIGH

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

vuln.today AI

8.7 HIGH

Network-reachable web UI (AV:N/AC:L), requires a low-privilege developer account (PR:L) and victim navigation (UI:R); stored XSS escapes the vulnerable component to the victim's session (S:C) with high C/I impact and no availability effect.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (GitLab).

CVSS VectorVendor: GitLab

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

Jun 11, 2026 - 13:01 EUVD

Analysis Generated

Jun 11, 2026 - 11:54 vuln.today

CVE Published

Jun 11, 2026 - 10:19 cve.org

HIGH 8.7

DescriptionCVE.org

GitLab has remediated an issue in GitLab EE affecting all versions from 17.1 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to execute arbitrary client-side code on behalf of a targeted user due to improper input sanitization in the Analytics Dashboard.

Articles & Coverage 3

medium.com CVE-2026-10087: Stored XSS in GitLab EE Analytics Dashboard Enables Client-Side Code Execution Jul 03, 2026 News 5 New GitLab Vulnerabilities - 5 High Severity, 4 With POC Jun 12, 2026 News 4 New GitLab Vulnerabilities - 4 High Severity, All With POC Jun 11, 2026

AnalysisAI

Stored cross-site scripting in GitLab Enterprise Edition's Analytics Dashboard allows an authenticated developer-role user to execute arbitrary client-side JavaScript in the browser of a targeted user, leveraging improper input sanitization. The flaw affects all 17.1 through 18.10.x, 18.11.x, and 19.0.x branches before fixed releases, and publicly available exploit code exists via a HackerOne report, raising the realistic risk of opportunistic abuse against multi-tenant GitLab instances.

Technical ContextAI

The issue is a CWE-79 (Improper Neutralization of Input During Web Page Generation, i.e. Cross-site Scripting) flaw in the Analytics Dashboard component of GitLab EE. CPE cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:* identifies GitLab as the affected product line, and per the GitLab advisory only Enterprise Edition is impacted because Analytics Dashboards are an EE-only feature. User-controlled fields rendered by the dashboard are not properly sanitized/encoded, so attacker-supplied markup is reflected/stored and executed in another user's browser session in the GitLab origin.

RemediationAI

Vendor-released patch: upgrade GitLab EE to 18.10.8, 18.11.5, or 19.0.2 as appropriate for your branch, per the GitLab patch release at https://about.gitlab.com/releases/2026/06/10/patch-release-gitlab-19-0-2-released/. Self-managed operators should apply the upgrade immediately given that exploit code is public; gitlab.com is already patched by GitLab. If patching must be deferred, compensating controls include restricting who can hold the Developer role on sensitive projects, disabling or restricting access to Analytics Dashboards (Settings > Analytics) for untrusted projects, and enforcing a strict Content-Security-Policy that disallows inline scripts on the GitLab origin - note that CSP tightening can break legitimate GitLab UI features and Analytics widgets, and disabling dashboards removes visibility for legitimate users.