GitLab CE/EE EUVD-2026-57438

The attacker must hold a valid GitLab account with at least low-level project access (PR:L) sufficient to write content that is later rendered in the analytics dashboard table cell context - the specific field or input vector is not detailed in available data beyond 'user-controlled values rendered in table cell content by an analytics dashboard component.' The victim must actively navigate to and view the affected analytics dashboard (UI:R), meaning passive background processes are not sufficient to trigger execution. Exploitation is limited to GitLab CE/EE versions 18.2.x through 19.0.5, 19.1.x through 19.1.3, and 19.2.x through 19.2.1; instances on GitLab.com are managed by GitLab and patched independently. Instances that do not use the analytics dashboard feature or restrict dashboard access to a narrow user population have significantly reduced real-world exposure despite the CVSS score.

The CVSS 8.7 score reflects genuine high risk: the network attack vector (AV:N) and low complexity (AC:L) mean the attack is straightforward once the attacker has any authenticated foothold. The scope change (S:C) with C:H and I:H is the critical driver - victims' full browser sessions are compromised, not just the attacker's own context. The requirement for low-privilege authentication (PR:L) narrows the attack surface compared to unauthenticated XSS, but on GitLab instances that allow open registration or have many users, this bar is easily cleared. UI:R (victim must view the dashboard) is a real limiting factor and explains why this is not in CISA KEV despite a public POC - exploitation is contingent on a victim navigating to the affected analytics view. EPSS data is not provided; however, the combination of public POC, scope change, and GitLab's wide enterprise deployment suggests prioritizing patching, especially for internet-exposed instances or those with untrusted user registration enabled.

An attacker with a low-privilege GitLab account (e.g., Reporter or Developer role) crafts a malicious payload targeting a field rendered as table cell content in the analytics dashboard - such as a project label, metric name, or custom value - embedding a JavaScript payload that exfiltrates the victim's session cookie or GitLab personal access token. When a project maintainer or administrator opens the analytics dashboard, their browser executes the payload and silently transmits their credentials to an attacker-controlled endpoint. A public proof-of-concept is available via HackerOne report #3830478, lowering the technical bar for exploitation.