Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to escalate privileges due to improper sanitization of HTML content rendered in a CI job modal.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.7",
  "pubDate": "2026-08-12T18:17:24.160Z",
  "pubdate": "2026-08-12T18:17:24.160Z",
  "executiveSummary": "A privilege escalation vulnerability exists in GitLab CE/EE affecting all versions from 19.2 prior to 19.2.2. The security flaw stems from improper sanitization of HTML content rendered within the continuous integration (CI) job modal component. An authenticated malicious user assigned the developer-role permissions can leverage this rendering flaw to execute unauthorized administrative actions or escalate privileges within the application context. The risk implications include a complete compromise of repository access controls and pipeline integrity, as successful exploitation breaks security boundaries established between developer and privileged user roles. Exploitation requirements mandate that the attacker possesses authenticated access with at least developer-role permissions and interacts with the vulnerable CI job modal interface. GitLab has remediated this issue in version 19.2.2 through robust input sanitization routines applied to the CI job modal rendering engine, mitigating the threat of unauthorized privilege escalation across affected CE/EE instances.",
  "technicalDetails": "The vulnerability resides within the GitLab CE/EE CI job modal component, specifically in how the application processes and renders dynamic HTML content derived from CI job outputs. The root cause is categorized as improper input sanitization and output encoding flaws, where untrusted string data presented within the modal interface fails to undergo rigorous contextual HTML escaping or filtering before DOM insertion. The vulnerable component processes malicious payloads injected into CI execution logs or job metadata, which are subsequently parsed and interpreted as active markup by the user browser when the job modal is rendered.\nThe attack vector requires network exposure to the GitLab instance and authentication with developer-role privileges. Although developer permissions normally restrict users from administrative functions, this vulnerability allows such users to bypass functional access controls. The step-by-step attack flow begins when an authenticated developer crafts a malicious payload—such as specially formatted HTML or JavaScript sequences—and introduces it into a CI job execution output or pipeline configuration artifact that gets loaded into the CI job modal. When an administrative or higher-privileged user interacts with or views the compromised CI job modal within the GitLab interface, the application improperly sanitizes the stored content and injects the raw HTML payload into the Document Object Model.\nPost-exploitation impact includes the execution of arbitrary scripts within the security context of the victim's session, potentially leading to unauthorized administrative actions, API token harvesting, or further privilege escalation across the GitLab deployment. Because the vulnerability relies on the insecure rendering of untrusted markup inside a privileged user's viewing context, remediation requires enforcing strict HTML sanitization policies using secure rendering libraries and robust Content Security Policy (CSP) headers to neutralize injected script execution and unauthorized markup interpretation."
}