CVE-2026-3093

MEDIUM

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

Title source: cna

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an attacker to execute arbitrary JavaScript in another user's browser via a crafted URL, due to improper sanitization of user-controlled input.

References (3)

Core 3

Core References

Exploit technical-description exploit permissions-required

HackerOne Bug Bounty Report #3539833

https://hackerone.com/reports/3539833

https://gitlab.com/gitlab-org/gitlab/-/work_items/591274

https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-1-released/

Scores

CVSS v3 4.7

EPSS 0.0024

EPSS Percentile 15.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-79

Status published

Products (3)

GitLab/GitLab 14.0 - 19.0.5

GitLab/GitLab 19.1 - 19.1.3

GitLab/GitLab 19.2 - 19.2.1

Published Jul 29, 2026

Tracked Since Jul 30, 2026