CVE-2026-10087: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

Synopsis

Stored cross-site scripting (XSS) in GitLab EE affects all versions from 17.1 up to the fixed releases. The flaw is reachable over the network by any authenticated user holding at least developer-level permissions, and exploiting it requires the attacker to get a targeted user to view a crafted Analytics Dashboard page. Successful exploitation lets the attacker run arbitrary JavaScript in the victim's browser session, enabling session hijacking, credential theft, or unauthorized actions performed as the victim. Patched-image rebuilds at versions 18.10.8, 18.11.5, and 19.0.2 are available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the GitLab EE instance over the network; the vulnerable Analytics Dashboard endpoint is exposed via HTTP/HTTPS.

• AuthenticationRequired

  Any account holding at least developer-role permissions is sufficient; no administrative access is needed.

• Victim interactionRequired

  The targeted user must view a crafted Analytics Dashboard page, requiring the attacker to deliver a link or embed the payload where the victim will encounter it.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no race conditions or special environmental prerequisites beyond the attacker having developer-level access.

Blast Radius

• The attacker executes arbitrary JavaScript inside the victim's active browser session, allowing session token theft and account takeover.
• Actions available to the victim user (including API calls, repository writes, and settings changes) can be performed on their behalf without consent.
• Confidential data visible to the victim, such as private repository contents, merge requests, and pipeline outputs, is readable by the attacker's injected script.