GitLab CE/EE: stored XSS in analytics dashboard pagination controls

Impact

User-controlled data rendered into an analytics dashboard's pagination controls is not neutralised, so an attacker with a low-privileged GitLab account can get script to run in the browser of another user who views the dashboard. On a self-managed GitLab that drives the fleet's CI/CD, the victim's session is the interesting part: it can reach project settings, CI variables, registry credentials and cluster deploy tokens - the material that pipelines use to push images and manifests onto GPU nodes. The CVSS vector records a changed scope with high confidentiality and integrity impact, and user interaction is required. Exploitation is conditional; GitLab describes it as occurring 'under certain conditions' without stating which.

Who can reach it

An authenticated GitLab user with enough access to place data into an analytics dashboard, plus a second user who views that dashboard. Requires user interaction.

What to do

Upgrade self-managed GitLab to 19.2.2, 19.1.4 or 19.0.6 depending on your branch; versions from 18.2 onward are affected. This is a package upgrade and service restart on the GitLab host - no node drain and no runner-side change. GitLab.com is already patched.

References