Cross-site scripting in GitLab Enterprise Edition and Gitlab Community Edition - CVE-2026-3093
Published: July 29, 2026 / Updated: July 30, 2026
Vulnerability identifier: #VU140482
CSH Severity: Medium
CVSS v4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2026-3093
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary JavaScript in another user's browser.
The vulnerability exists due to cross-site scripting in paginated views when a victim visits a crafted URL. A remote attacker can send a crafted URL to execute arbitrary JavaScript in another user's browser.
User interaction is required for the victim to open the crafted URL.
Affected software
GitLab Enterprise Edition
Gitlab Community Edition
Gitlab Community Edition
How to mitigate CVE-2026-3093
Install security update from vendor's website.
GitLab Enterprise Edition - addressed in versions 19.0.5, 19.1.3, 19.2.1
Gitlab Community Edition - addressed in versions 19.0.5, 19.1.3, 19.2.1
Gitlab Community Edition - addressed in versions 19.0.5, 19.1.3, 19.2.1