Executive brief
GitLab has fixed a security vulnerability in its software development platform that could allow a logged-in user to run malicious code in another user's web browser. This type of attack, known as Cross-Site Scripting, could be used to perform actions on behalf of the victim or steal sensitive session information. Organizations using GitLab versions 18.11.0 through 18.11.2 should update to version 18.11.3 immediately to mitigate this risk.
Technical details
A stored Cross-Site Scripting (XSS) vulnerability exists in GitLab CE/EE versions 18.11.0 through 18.11.2. The flaw stems from improper neutralization of input during web page generation (CWE-79), allowing an authenticated attacker to inject malicious scripts. When a victim views the affected page, the script executes within the context of their browser session. This can lead to unauthorized actions performed on behalf of the victim or the disclosure of sensitive session tokens. The issue is resolved in GitLab version 18.11.3.
Affected products
- GitLab GitLab Community Edition (CE) 18.11 to 18.11.2
- GitLab GitLab Enterprise Edition (EE) 18.11 to 18.11.2
Timeline
- 2026-05-13: patched: GitLab released version 18.11.3 to address the issue.
- 2026-05-14: disclosed: Vulnerability publicly disclosed via NVD and GitLab advisory.