Cross-Site Scripting in GitLab Community and Enterprise Editions
CVE-2026-15217

8.7HIGH

Key Information:

Vendor

Gitlab
Status
Gitlab
Vendor
CVE Published:
12 August 2026

What is CVE-2026-15217?

GitLab has addressed an issue in its Community and Enterprise Editions that could enable cross-site scripting (XSS) under specific conditions. This vulnerability arises from improper handling of user-controlled inputs rendered in the analytics dashboard's table cell content. The flaw potentially allows attackers to execute malicious scripts in user browsers, compromising data integrity and user sessions. GitLab strongly advises all users to upgrade to the patched versions to mitigate this security risk.

Affected Version(s)

GitLab 18.2 < 19.0.6

GitLab 19.1 < 19.1.4

GitLab 19.2 < 19.2.2

References

https://gitlab.com/gitlab-org/gitlab/-/work_items/605449
https://hackerone.com/reports/3830478
technical-descriptionexploitpermissions-required
https://docs.gitlab.com/releases/patches/patch-release-gi...

CVSS V3.1

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Thanks [yvvdwf](https://hackerone.com/yvvdwf) for reporting this vulnerability through our HackerOne bug bounty program
.