Executive brief
GitLab's Content Editor feature fails to properly sanitize user-pasted HTML, allowing attackers to inject malicious JavaScript that runs in other users' browsers. An unauthenticated attacker can craft a malicious paste operation to steal session tokens, modify content, or perform actions on behalf of a targeted victim without the victim's knowledge.
Technical details
This is a cross-site scripting (XSS) vulnerability in GitLab CE/EE's Content Editor component, caused by improper sanitization of HTML content during paste operations. An unauthenticated attacker can craft a malicious HTML payload and trick a user into pasting it into the Content Editor, which will execute arbitrary JavaScript in the victim's authenticated session context. The vulnerability affects versions 19.0.x before 19.1.8, 19.2.x before 19.2.6, and 19.3.x before 19.3.2. No authentication is required to exploit this; the attack vector requires user interaction (pasting content). GitLab has patched this issue in the versions listed above.
Affected products
- GitLab GitLab CE 19.0 before 19.1.8, 19.2 before 19.2.6, 19.3 before 19.3.2
- GitLab GitLab EE 19.0 before 19.1.8, 19.2 before 19.2.6, 19.3 before 19.3.2
Timeline
- 2026-09-16: disclosed
- 2026-09-10: patched: Versions 19.3.2, 19.2.6, 19.1.8 released with fixes