Executive brief
GitLab has fixed a security flaw in its software development platform that could allow an attacker to run malicious code in another user's web browser. By tricking a user into clicking a specially crafted link, an attacker could potentially steal session information or perform actions on the user's behalf. This affects self-managed GitLab installations, while GitLab.com and GitLab Dedicated environments have already been secured.
Technical details
A reflected cross-site scripting (XSS) vulnerability exists in GitLab CE/EE within paginated views. The flaw stems from improper sanitization of user-controlled input, allowing an attacker to inject and execute arbitrary JavaScript in the context of a victim's browser session via a crafted URL. Exploitation requires network reachability and user interaction (clicking a malicious link), and it is characterized by a high attack complexity. GitLab has released patches in versions 19.0.5, 19.1.3, and 19.2.1 to address this issue.
Affected products
- GitLab GitLab Community Edition (CE) 14.0 to <19.0.5, 19.1 to <19.1.3, 19.2 to <19.2.1
- GitLab GitLab Enterprise Edition (EE) 14.0 to <19.0.5, 19.1 to <19.1.3, 19.2 to <19.2.1
Timeline
- 2026-07-29: disclosed
- 2026-07-29: patched: Released in versions 19.2.1, 19.1.3, 19.0.5