Cross-site scripting in GitLab Enterprise Edition and Gitlab Community Edition - CVE-2026-92883
Published: October 13, 2026
Vulnerability identifier: #VU154151
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2026-92883
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary JavaScript in other users' browser sessions.
The vulnerability exists due to cross-site scripting caused by improper sanitization of HTML attributes in syntax-highlighting output when rendering repository content. A remote user can supply a specially crafted repository to execute arbitrary JavaScript in other users' browser sessions.
User interaction is required.
Affected software
GitLab Enterprise Edition
Gitlab Community Edition
Gitlab Community Edition
How to mitigate CVE-2026-92883
Install security update from vendor's website.
GitLab Enterprise Edition - addressed in versions 19.2.8, 19.3.4, 19.4.2
Gitlab Community Edition - addressed in versions 19.2.8, 19.3.4, 19.4.2
Gitlab Community Edition - addressed in versions 19.2.8, 19.3.4, 19.4.2