CVE-2026-6073: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
GitLab has remediated an issue in GitLab EE affecting all versions from 18.7 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user to execute arbitrary JavaScript in other users' browsers due to improper input sanitization.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GitLab EEto a version that resolves this vulnerability.Fixed in 18.9.7 - Upgrade
Upgrade
GitLab EEto a version that resolves this vulnerability.Fixed in 18.10.6 - Upgrade
Upgrade
GitLab EEto a version that resolves this vulnerability.Fixed in 18.11.3
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6073?
CVE-2026-6073 is classified as a medium severity vulnerability due to improper neutralization of input during web page generation.
How do I fix CVE-2026-6073?
To fix CVE-2026-6073, ensure your GitLab EE version is updated to 18.9.7, 18.10.6, or 18.11.3 or later.
What type of vulnerability is CVE-2026-6073?
CVE-2026-6073 is a Cross-site Scripting (XSS) vulnerability that allows authenticated users to execute arbitrary scripts.
Which versions of GitLab EE are affected by CVE-2026-6073?
CVE-2026-6073 affects GitLab EE versions from 18.7 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3.
Who reported CVE-2026-6073?
CVE-2026-6073 was reported on HackerOne, emphasizing the importance of secure coding practices to prevent XSS vulnerabilities.