Database/Control plane, storage & DevOps

GitLab CE/EE: stored XSS via crafted repository content in syntax-highlighted output

CVSS 8.7CVE-2026-92883Control plane, storage & DevOpscurated

Impact

GitLab is where many fleets keep the pipelines that build images, sign artifacts, and push cluster manifests, so a session-hijack primitive there is a supply-chain foothold rather than a web bug. Improper sanitization of HTML attributes in syntax-highlighted output lets an authenticated user who can create a repository execute arbitrary JavaScript in another user's browser session when that user views the crafted file. CVSS scope is marked changed, reflecting the jump from the attacker's own project into the victim's authenticated context - which for a maintainer or admin means their CI variables, runner registration tokens, and protected-branch rights. Victim interaction is required: someone has to open the file.

Who can reach it

Network, authenticated as any user who can push a repository or a merge request to a viewable project; the victim must then view the crafted file in the GitLab UI.

What to do

Upgrade to GitLab 19.2.8, 19.3.5, or 19.4.2 per the patch release. Self-managed operators take a standard GitLab upgrade and service restart - no node drain, but the instance is briefly unavailable; GitLab.com is already patched. There is no configuration-level mitigation named in the advisory, so plan the upgrade rather than a workaround.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-92883 https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/https://gitlab.com/gitlab-org/gitlab/-/work_items/629523 https://hackerone.com/reports/3936831

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.