CVE-2026-7377: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
GitLab has remediated an issue in GitLab EE affecting all versions from 18.7 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that, in customizable analytics dashboards, could have allowed an authenticated user to execute arbitrary JavaScript in the context of other users' browsers due to improper input sanitization.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GitLab EEto a version that resolves this vulnerability.Fixed in 18.9.7 - Upgrade
Upgrade
GitLab EEto a version that resolves this vulnerability.Fixed in 18.10.6 - Upgrade
Upgrade
GitLab EEto a version that resolves this vulnerability.Fixed in 18.11.3
Event History
Frequently Asked Questions
What is the severity of CVE-2026-7377?
CVE-2026-7377 is classified as a medium severity vulnerability due to its potential for exploitation through cross-site scripting.
How do I fix CVE-2026-7377?
To fix CVE-2026-7377, upgrade GitLab EE to version 18.9.7 or later, 18.10.6 or later, or 18.11.3 or later.
Which versions of GitLab EE are affected by CVE-2026-7377?
CVE-2026-7377 affects GitLab EE versions from 18.7 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3.
What type of vulnerability is CVE-2026-7377?
CVE-2026-7377 is classified as a Cross-site Scripting (XSS) vulnerability.
What impact does CVE-2026-7377 have on GitLab users?
CVE-2026-7377 could allow an attacker to inject malicious scripts into customizable analytics dashboards, impacting the security of GitLab users.