CVE-2026-6335: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.11 before 18.11.3 that under certain conditions could have allowed an authenticated user to execute arbitrary code in another user's browser session due to improper sanitization.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 18.11.3
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6335?
CVE-2026-6335 is classified as a medium severity vulnerability due to its potential for cross-site scripting attacks.
How do I fix CVE-2026-6335?
To remediate CVE-2026-6335, update to GitLab version 18.11.3 or later.
What versions of GitLab are affected by CVE-2026-6335?
CVE-2026-6335 affects all versions of GitLab CE/EE from 18.11 before 18.11.3.
Can CVE-2026-6335 be exploited by unauthenticated users?
No, CVE-2026-6335 can only be exploited by authenticated users under certain conditions.
What risks does CVE-2026-6335 pose to GitLab users?
CVE-2026-6335 can allow authenticated users to execute arbitrary code in the context of another user's session, leading to potential data breaches.