Arbitrary JavaScript Execution in GitLab CE/EE
CVE-2026-84739

8.7HIGH

Key Information:

Vendor

Gitlab
Status
Gitlab
Vendor
CVE Published:
29 September 2026

What is CVE-2026-84739?

GitLab has addressed a security vulnerability that allowed authenticated users to execute arbitrary JavaScript within another user's browser session. The issue arose from improper sanitization of path components in the merge request diff viewer, which could lead to unwarranted permissions being granted to malicious scripts. This flaw potentially impacts users across multiple versions of GitLab CE/EE, underscoring the importance of keeping systems updated to the latest versions to mitigate such risks.

Affected Version(s)

GitLab 13.11 < 19.2.7

GitLab 19.3 < 19.3.3

GitLab 19.4 < 19.4.1

References

https://gitlab.com/gitlab-org/gitlab/-/work_items/627316
https://hackerone.com/reports/3938482
technical-descriptionexploitpermissions-required
https://docs.gitlab.com/releases/patches/patch-release-gi...

CVSS V3.1

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Thanks [joaxcar](https://hackerone.com/joaxcar) for reporting this vulnerability through our HackerOne bug bounty program
.