Volerion logoVolerion
Volerion logoVolerion

GitLab CE/EE Cross-Site Scripting Vulnerability in Storybook Development Environment

Vulnerability

A cross-site scripting vulnerability has been addressed in GitLab Community Edition (CE) and Enterprise Edition (EE) versions 16.1.0 prior to 18.9.6, 18.10 prior to 18.10.4, and 18.11 prior to 18.11.1. Under certain conditions, this vulnerability could have allowed an unauthenticated user to access tokens in the Storybook development environment due to improper input validation.

Impact

Exploitation of this vulnerability could have led to cross-site scripting, allowing for the injection of malicious scripts that could be executed in the context of the user's browser.

Remediation

Users are advised to upgrade to GitLab versions 18.11.1, 18.10.4, or 18.9.6. Instructions for updating GitLab can be found on the GitLab Update page.

Added: Apr 22, 2026, 5:23 PM
Updated: Apr 22, 2026, 5:23 PM

Vulnerability Rating

Custom Algorithm
spread
7.3
impact
3.5
exploitability
7.1
remediation
7.7
relevance
6.5
threat
6.4
urgency
2.9
incentive
0.0

Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.