JavaScript Injection Vulnerability in GitLab CE/EE
CVE-2026-19619

4.7MEDIUM

Key Information:

Vendor

Gitlab
Status
Gitlab
Vendor
CVE Published:
16 September 2026

What is CVE-2026-19619?

An improper sanitization vulnerability in GitLab CE/EE allows an unauthenticated user to potentially execute arbitrary JavaScript in a targeted user's session by leveraging malformed HTML content pasted into the Content Editor. This flaw affects all versions from 19.0 up to but not including 19.1.8, 19.2 up to but not including 19.2.6, and 19.3 up to but not including 19.3.2. Security measures should be taken to ensure that HTML content is adequately validated to prevent exploitation.

Affected Version(s)

GitLab 19.0 < 19.1.8

GitLab 19.2 < 19.2.6

GitLab 19.3 < 19.3.2

References

https://gitlab.com/gitlab-org/gitlab/-/work_items/612792
https://hackerone.com/reports/3808840
technical-descriptionexploitpermissions-required
https://docs.gitlab.com/releases/patches/patch-release-gi...

CVSS V3.1

Score:
4.7
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Thanks [lucvs](https://hackerone.com/lucvs) for reporting this vulnerability through our HackerOne bug bounty program
.