EUVD-2026-50486
GHSA-2rc9-8cx9-fxpr
Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
AV:N and PR:N because the attacker delivers a crafted URL with no account; AC:H reflects the specific endpoint or encoding condition required; UI:R and S:C capture the browser-side execution crossing origin boundaries.
Primary rating from Vendor (GitLab).
CVSS VectorVendor: GitLab
Lifecycle Timeline
3DescriptionCVE.org
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an attacker to execute arbitrary JavaScript in another user's browser via a crafted URL, due to improper sanitization of user-controlled input.
AnalysisAI
Reflected cross-site scripting in GitLab CE/EE across a vast version range (14.0 through pre-patch releases) enables an unauthenticated attacker to execute arbitrary JavaScript in a victim's browser by enticing them to open a crafted URL. The CVSS vector confirms no authentication is required on the attacker side (PR:N), user interaction is needed (UI:R), and the scope changes (S:C) - meaning the injected script runs outside the originating page's trust boundary, enabling session hijacking, credential theft, or actions performed on the victim's behalf. A publicly available exploit exists on HackerOne (report #3539833), raising the practical risk above what the moderate CVSS score of 4.7 alone suggests.
Technical ContextAI
CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting) describes a failure to encode or sanitize user-controlled data before rendering it in an HTML context. The CVSS vector's S:C (Changed) metric indicates this is a reflected XSS crossing the browser's same-origin policy - script injected via a crafted GitLab URL executes in the context of the GitLab origin, giving it access to session cookies, localStorage tokens, and the ability to make authenticated API requests. The affected product is GitLab CE/EE, a Ruby on Rails-based DevSecOps platform; CPE cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:* covers both Community and Enterprise editions across all platforms. The root cause is improper sanitization of user-supplied input before it is reflected into page output, a classic unsanitized-reflection pattern.
RemediationAI
Upgrade to one of the patched releases confirmed by GitLab's patch advisory: GitLab 19.0.5, 19.1.3, or 19.2.1. The advisory is published at https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-1-released/ and the underlying issue is tracked at https://gitlab.com/gitlab-org/gitlab/-/work_items/591274. For organizations unable to patch immediately, a meaningful compensating control is to restrict access to GitLab to trusted internal networks or VPN only, reducing the attacker's ability to deliver crafted URLs to authenticated users from external infrastructure - note this does not eliminate the vulnerability for insider-threat scenarios. Enforcing strict Content Security Policy (CSP) headers at the reverse proxy layer may reduce XSS exploitability in some configurations, but effectiveness depends on existing CSP directives and should be validated. User awareness about not clicking unsolicited GitLab links is a low-assurance control only. Patching remains the only confirmed remediation.
An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. Rated critical severity (CVSS 10
An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.
Unauthenticated arbitrary file read in GitLab CE/EE lets remote attackers retrieve files from the GitLab server via the
The SSH key upload feature (lib/gitlab_keys.rb) in gitlab-shell before 1.7.3, as used in GitLab 5.0 before 5.4.1 and 6.x
A vulnerability in GitLab CE/EE affecting all versions from 11.10 prior to 15.1.6, 15.2 to 15.2.4, 15.3 to 15.3.2 allows
Sensitive credential and configuration disclosure in GitLab Enterprise Edition allows an authenticated user with Duo Cha
The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4
The Ruby SAML library is for implementing the client side of a SAML authorization. Rated critical severity (CVSS 9.8), t
A hardcoded password was set for accounts registered using an OmniAuth provider (e.g. Rated critical severity (CVSS 9.8)
An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.10 before 14.6.5, all versions star
When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab af
An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7.9 before 13.8.7, all versions sta
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today