Volerion logoVolerion
Volerion logoVolerion

GitLab EE Input Sanitization Vulnerability Allowing Cross-Site Scripting

Vulnerability

A cross-site scripting vulnerability has been identified in GitLab EE, affecting all versions from 16.4 prior to 18.9.7, 18.10 prior to 18.10.6, and 18.11 prior to 18.11.3. The issue arises from improper input sanitization, which could have allowed an authenticated user with developer-role permissions to execute arbitrary JavaScript in the browsers of other users.

Impact

Exploitation of this vulnerability could lead to cross-site scripting, allowing for the execution of malicious scripts in the context of the user's browser.

Added: May 14, 2026, 6:42 AM
Updated: May 14, 2026, 6:42 AM

Vulnerability Rating

Custom Algorithm
spread
7.3
impact
1.7
exploitability
6.3
remediation
7.7
relevance
8.4
threat
6.4
urgency
2.9
incentive
0.0

Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.