CVE-2026-92883: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to execute arbitrary JavaScript in the context of other users' browser sessions via a specially crafted repository, due to improper sanitization of HTML attributes in syntax-highlighted output.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 19.2.8 - Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 19.3.5 - Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 19.4.2
Event History
Frequently Asked Questions
Which GitLab versions need remediation?
GitLab CE/EE versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 are affected. Upgrade to 19.2.8, 19.3.5, 19.4.2, or a later version in the applicable release line.
What access and user interaction are required for exploitation?
An attacker needs an authenticated GitLab account and must craft a repository that triggers the unsafe syntax-highlighted output. Another user must view the affected content in their browser for the attacker’s JavaScript to execute in that user’s session context.
Who is most exposed?
GitLab instances where authenticated users can create or contribute repositories are exposed, particularly where other users review or browse repository content. The issue can affect other users’ browser sessions and has high confidentiality and integrity impact.