Arbitrary JavaScript Execution Vulnerability in GitLab CE/EE
CVE-2026-5816

8HIGH

Key Information:

Vendor

Gitlab
Status
Gitlab
Vendor
CVE Published:
22 April 2026

What is CVE-2026-5816?

A vulnerability in GitLab CE/EE allows an unauthenticated user to execute arbitrary JavaScript in a victim's browser session due to inadequate path validation under specific conditions. This issue affects all versions from 18.10 before 18.10.4 and 18.11 before 18.11.1, potentially compromising user data and session integrity. Users are encouraged to update to the patched versions to mitigate this security risk.

Affected Version(s)

GitLab 18.10 < 18.10.4

GitLab 18.11 < 18.11.1

References

https://hackerone.com/reports/3572231
technical-descriptionexploitpermissions-required
https://gitlab.com/gitlab-org/gitlab/-/work_items/592816
https://about.gitlab.com/releases/2026/04/22/patch-releas...

CVSS V3.1

Score:
8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Thanks [joaxcar](https://hackerone.com/joaxcar) for reporting this vulnerability through our HackerOne bug bounty program
.