Cross-site scripting in GitLab Enterprise Edition and Gitlab Community Edition - CVE-2026-84739
Published: September 23, 2026
Vulnerability identifier: #VU151875
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2026-84739
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary JavaScript in another user's browser session.
The vulnerability exists due to improper sanitization of path components in the merge request diff viewer when rendering merge request diffs. A remote user can provide crafted path components to execute arbitrary JavaScript in another user's browser session.
User interaction is required.
Affected software
GitLab Enterprise Edition
Gitlab Community Edition
Gitlab Community Edition
How to mitigate CVE-2026-84739
Install security update from vendor's website.
GitLab Enterprise Edition - addressed in versions 19.2.7, 19.3.3, 19.4.1
Gitlab Community Edition - addressed in versions 19.2.7, 19.3.3, 19.4.1
Gitlab Community Edition - addressed in versions 19.2.7, 19.3.3, 19.4.1