CVE-2026-4332
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
GitLab EE versions 18.2 to 18.8.9, 18.9 to 18.9.5, and 18.10 to 18.10.3 have a vulnerability in customizable analytics dashboards allowing an authenticated user to execute arbitrary JavaScript in other users' browsers due to improper input sanitization.
Risk Assessment
XSS attack could lead to session theft, data leakage, or other actions on the victim's account within GitLab.
Recommendation
Update GitLab EE to version 18.8.9, 18.9.5, 18.10.3 or later, depending on the branch in use.
Original NVD description (English source)
GitLab has remediated an issue in GitLab EE affecting all versions from 18.2 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that, in customizable analytics dashboards, could have allowed an authenticated user to execute arbitrary JavaScript in the context of other users' browsers due to improper input sanitization.