CVE-2026-3093: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an attacker to execute arbitrary JavaScript in another user's browser via a crafted URL, due to improper sanitization of user-controlled input.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 19.0.5 - Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 19.1.3 - Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 19.2.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-3093?
The severity of CVE-2026-3093 is classified as medium with a CVSS score of 4.7.
How do I fix CVE-2026-3093?
To fix CVE-2026-3093, upgrade GitLab to versions 19.0.5, 19.1.3, or 19.2.1 or later.
What type of vulnerability is CVE-2026-3093?
CVE-2026-3093 is an improper neutralization of input during web page generation, commonly known as a Cross-site Scripting (XSS) vulnerability.
Which versions of GitLab are affected by CVE-2026-3093?
CVE-2026-3093 affects GitLab CE/EE versions 14.0 to prior 19.0.5, 19.1 to prior 19.1.3, and 19.2 to prior 19.2.1.
What could an attacker do with CVE-2026-3093?
An attacker could potentially execute arbitrary JavaScript in another user's browser via a crafted URL due to this vulnerability.