Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed cross-site scripting due to improper neutralization of user-controlled data rendered in pagination controls by an analytics dashboard component.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.7",
  "pubDate": "2026-08-12T20:17:36.513Z",
  "pubdate": "2026-08-12T20:17:36.513Z",
  "executiveSummary": "A cross-site scripting (XSS) vulnerability has been identified and remediated in GitLab CE/EE. The flaw stems from the improper neutralization of user-controlled data that is dynamically rendered within the pagination controls of an analytics dashboard component. Under specific conditions, this vulnerability allows threat actors to inject malicious scripts into the application context, which are subsequently executed within the victim user's browser session.\nThe affected systems include all versions of GitLab CE/EE from 18.2 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2. Successful exploitation of this issue can lead to unauthorized actions performed on behalf of the victim, session hijacking, or data exfiltration, depending on the privileges of the targeted user and the context of the rendered component. The risk implications include potential compromise of user integrity and unauthorized access to sensitive interface elements within the analytics dashboard.\nAttacker capabilities require the ability to supply or influence user-controlled data that is processed and rendered by the analytics dashboard pagination controls. Specific conditions must be met for the payload to execute successfully upon interaction with or viewing of the affected pagination elements.",
  "technicalDetails": "The root cause of the vulnerability resides in the inadequate sanitization and improper neutralization of user-controlled input prior to rendering within the pagination controls of the analytics dashboard component. When the application constructs the pagination interface, it fails to properly encode or escape input data containing malicious script constructs, resulting in DOM-based or reflected cross-site scripting behavior.\nThe vulnerable component is the analytics dashboard pagination control mechanism within GitLab CE/EE. Affected versions span all deployments of GitLab CE/EE from 18.2 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2. Network exposure is inherent to the web application interface, requiring HTTP/HTTPS access to the GitLab instance where the vulnerable analytics dashboard is accessible.\nThe step-by-step attack flow involves the following phases: 1) An adversary crafts a malicious payload containing executable script content designed to target the user-controlled data fields processed by the analytics dashboard. 2) The adversary injects this payload into the application data flow such that it is incorporated into the pagination controls. 3) A victim user navigates to or interacts with the analytics dashboard pagination interface where the unsanitized data is rendered. 4) The browser parses the response and executes the injected script within the security context of the user's session, leading to potential session compromise, unauthorized API calls, or unauthorized interactions with the GitLab instance."
}