GitLab CE/EE: Stored cross-site scripting in syntax highlighting
Summary
GitLab Community Edition and Enterprise Edition contain a stored cross-site scripting flaw (CWE-79) in the syntax-highlighted output of repository files. Because HTML attributes are not sanitized properly, an authenticated user can craft a repository that runs arbitrary JavaScript in other users' browser sessions. Exploitation requires a victim to view the crafted content, and the CVSS score is 8.7 with a changed scope.
Affected
- GitLab CE/EE from 19.1 before 19.2.8
- GitLab CE/EE from 19.3 before 19.3.5
- GitLab CE/EE from 19.4 before 19.4.2
- The default configuration is unaffected according to the CVE record.
Fixed in
- Upgrade to GitLab 19.2.8, 19.3.5 or 19.4.2 or later.
Workaround
Unknown.
Exploitation
- No evidence of exploitation in the wild found for this CVE; CISA KEV listing to be verified.
- No public proof-of-concept found.
- CISA SSVC: exploitation none, automatable no, technical impact total.
Our recommendation
- Check your GitLab version and upgrade self-managed instances to 19.2.8, 19.3.5 or 19.4.2 at minimum.
- Also upgrade to the newest patch of your branch, because the same release train addresses the critical CVE-2026-97229 regex flaw, which is not covered by these versions alone.
- Review who can create accounts and repositories, and restrict open sign-up on internet-facing instances.
- Monitor for a KEV listing and for the public issue details expected around January 2027.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitLab Critical Patch Release 19.4.2, 19.3.5, 19.2.8 docs.gitlab.com
- GitLab work item 629523 gitlab.com
- HackerOne report 3936831 hackerone.com
- CSO Online: GitLab patches a max-severity regex flaw www.csoonline.com
- Cyberexperts: GitLab critical patch cyberexperts.com
- Konfirmity: GitLab critical patch release advisory www.konfirmity.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 04:37.
Original description (NVD)
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to execute arbitrary JavaScript in the context of other users' browser sessions via a specially crafted repository, due to improper sanitization of HTML attributes in syntax-highlighted output.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.