Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed cross-site scripting due to improper neutralization of user-controlled values rendered in table cell content by an analytics dashboard component.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.7",
  "pubDate": "2026-08-12T20:17:36.667Z",
  "pubdate": "2026-08-12T20:17:36.667Z",
  "executiveSummary": "A cross-site scripting vulnerability has been identified and remediated in GitLab CE/EE. The flaw stems from improper neutralization of user-controlled values rendered within table cell content by an analytics dashboard component. Under specific operational conditions, this improper output handling allows malicious actors to inject arbitrary client-side scripts, such as JavaScript, into the context of other users viewing the affected dashboard.\nThe vulnerability affects GitLab CE/EE versions ranging from 18.2 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2. Successful exploitation of this flaw can lead to severe security implications, including session hijacking, unauthorized actions performed on behalf of authenticated users, and exposure of sensitive data accessible within the web application session.\nExploitation requires an attacker to inject malicious payloads into user-controlled data fields that are subsequently processed and displayed inside table cells on the analytics dashboard. When a victim accesses the compromised dashboard component, the injected script executes within their browser session under the security context of the application. Mitigation requires upgrading the affected GitLab installations to the patched version releases provided by the vendor.",
  "technicalDetails": "The root cause of the vulnerability resides in the inadequate sanitization and neutralization of user-supplied input prior to rendering it in the user interface. Specifically, an analytics dashboard component fails to properly encode or escape user-controlled values before embedding them directly into table cell content. Consequently, when the application constructs the Document Object Model (DOM) for the table cells, any raw HTML or JavaScript provided via the unmitigated input vector is treated as executable code rather than inert string data.\nThe affected components are part of the GitLab CE/EE analytics dashboard feature set across versions 18.2 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2. The attack vector involves an authenticated or unauthenticated adversary—depending on the specific data ingestion vector—introducing a crafted payload containing executable script syntax into a data field that is later surfaced within the analytics reporting interface.\nThe step-by-step attack flow initiates when the malicious payload is stored or reflected through the data ingestion pipeline associated with the analytics dashboard. Once the data is processed, the vulnerable analytics dashboard component queries or receives the dataset. During the rendering phase, the component outputs the raw, unescaped string into the table cell element of the HTML document. When a target user navigates to the analytics dashboard, the victim's web browser parses the incoming response, encounters the malicious script tag or event handler embedded within the table cell, and executes the script in the context of the victim's active session. This payload behavior enables the execution of arbitrary JavaScript, facilitating session token theft, DOM manipulation, unauthorized API requests, and subsequent post-exploitation activities against the host application."
}