EUVD-2026-88687
GHSA-hrj5-qwx9-f2q7
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Network-reachable diff viewer with a low-priv account (PR:L) and required victim view (UI:R); XSS runs in the victim's session (S:C) enabling session/data theft and actions (C:H/I:H), no availability impact.
Primary rating from Vendor (GitLab).
CVSS VectorVendor: GitLab
Lifecycle Timeline
3DescriptionCVE.org
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.11 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary JavaScript in the context of another user's browser session due to improper sanitization of path components in the merge request diff viewer.
AnalysisAI
Stored cross-site scripting in GitLab CE/EE lets an authenticated user who can create or modify a merge request embed crafted content in a path component that the merge request diff viewer fails to sanitize, so arbitrary JavaScript executes in the browser session of any other user who views that diff. All versions from 13.11 up to the fixed releases 19.2.7, 19.3.3 and 19.4.1 are affected; the CVSS 3.1 base score is 8.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N), reflecting network reachability, low privileges required, mandatory victim interaction, and a scope change because the attacker compromises a different user's session rather than their own. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated GitLab CE/EE account with sufficient privilege to create or modify a merge request (PR:L), and a specific triggering condition: the crafted malicious content must reside in a path component that flows into the merge request diff viewer, which improperly sanitizes it. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine priority, not a paper tiger. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to GitLab 19.2.7, 19.3.3, or 19.4.1 (or later) on the applicable maintenance track, as documented in the patch release advisory at https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-1-released/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Vendor-released patch: 19.2.7, 19.3.3, 19.4.1. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. Rated critical severity (CVSS 10
An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.
When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab af
Unauthenticated arbitrary file read in GitLab CE/EE lets remote attackers retrieve files from the GitLab server via the
The SSH key upload feature (lib/gitlab_keys.rb) in gitlab-shell before 1.7.3, as used in GitLab 5.0 before 5.4.1 and 6.x
A vulnerability in GitLab CE/EE affecting all versions from 11.10 prior to 15.1.6, 15.2 to 15.2.4, 15.3 to 15.3.2 allows
Sensitive credential and configuration disclosure in GitLab Enterprise Edition allows an authenticated user with Duo Cha
The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4
Authenticated code execution on the GitLab server is possible in GitLab CE/EE 19.2 through 19.4.0, where an integer over
Authenticated users who can define or modify a CI/CD configuration can achieve remote code execution on GitLab CE/EE ser
Unauthenticated path traversal in the @zereight/mcp-gitlab Model Context Protocol server prior to version 2.1.27 allows
The Ruby SAML library is for implementing the client side of a SAML authorization. Rated critical severity (CVSS 9.8), t
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today