CVE-2026-84739: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.11 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary JavaScript in the context of another user's browser session due to improper sanitization of path components in the merge request diff viewer.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 19.2.7 - Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 19.3.3 - Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 19.4.1
Event History
Frequently Asked Questions
Which GitLab versions need remediation?
Affected versions are 13.11 through versions before 19.2.7, 19.3 through versions before 19.3.3, and 19.4 through versions before 19.4.1. Upgrade to 19.2.7, 19.3.3, 19.4.1, or a later release as appropriate.
What does an attacker need to exploit this issue?
The attacker must be an authenticated GitLab user and must cause another user to view a merge request diff under the affected conditions. Successful exploitation executes arbitrary JavaScript in the other user's browser session.
Where does the vulnerable input appear?
The issue involves improper sanitization of path components displayed by the merge request diff viewer. Exposure therefore depends on users viewing merge request diffs containing attacker-controlled path components.