CVE-2026-4332: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
GitLab has remediated an issue in GitLab EE affecting all versions from 18.2 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that, in customizable analytics dashboards, could have allowed an authenticated user to execute arbitrary JavaScript in the context of other users' browsers due to improper input sanitization.
Other sources
GitLab has remediated an issue that, in customizable analytics dashboards, could have allowed an authenticated user to execute arbitrary JavaScript in the context of other users’ browsers due to improper input sanitization.
— GitLab
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 18.8.9Fixed in 18.9.5Fixed in 18.10.3 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 18.8.9 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 18.9.5 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 18.10.3
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2026-4332?
The severity of CVE-2026-4332 is considered moderate due to the potential for an authenticated user to exploit cross-site scripting vulnerabilities.
How do I fix CVE-2026-4332?
To fix CVE-2026-4332, you should upgrade GitLab EE to versions 18.8.9, 18.9.5, or 18.10.3 or later.
Which versions of GitLab EE are affected by CVE-2026-4332?
CVE-2026-4332 affects GitLab EE versions from 18.2 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3.
What types of vulnerabilities does CVE-2026-4332 address?
CVE-2026-4332 addresses a cross-site scripting vulnerability specifically in customizable analytics dashboards.
Who is impacted by CVE-2026-4332?
Authenticated users of GitLab EE versions specified in the advisory are impacted by CVE-2026-4332.