CVE-2026-8589: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

Synopsis

A stored cross-site scripting (XSS) vulnerability affects GitLab EE versions from 13.1.4 up to the fix releases. The flaw is reachable over the network and requires an admin-level account plus a victim's interaction to trigger, derived from the CVSS vector. Successful exploitation allows an authenticated attacker to inject malicious script content that runs in a targeted user's browser, enabling unauthorized email address injection into that user's account and exposing sensitive data. Patched-image rebuilds at versions 18.10.8, 18.11.5, and 19.0.2 are available on HarborGuard for environments running affected versions.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the GitLab EE web interface over the network; there is no local or physical access requirement.

• AuthenticationRequired

  An admin or privileged account is needed; low-privilege access alone is not sufficient to reach the vulnerable group setting fields.

• Victim interactionRequired

  A targeted user must interact with the injected content (for example, visit the affected page) for the malicious script to execute in their browser.

• Attack complexityDetail

  Exploit success depends on specific environmental or timing conditions, such as the target visiting the affected group settings page while the payload is active.

Blast Radius

• Reads session tokens or authentication credentials from the victim's browser context.
• Injects unauthorized email addresses into the targeted user's GitLab account, enabling account takeover or notification hijacking.
• Modifies account-level settings on behalf of the victim by scripting actions within their authenticated session.