CVE-2026-92883

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 19.1 through 19.2.7 GitLab CE/EE versions 19.3 through 19.3.4 GitLab CE/EE versions 19.4 through 19.4.1

Description An issue exists where improper sanitization of HTML attributes in syntax-highlighted output allows an authenticated user to execute arbitrary JavaScript within the browser sessions of other users. This is achieved by using a specially crafted repository, leading to Cross-site Scripting (XSS), which is a technique used to inject malicious scripts into benign and trusted websites.

Recommendations Update GitLab CE/EE versions 19.1 through 19.2.7 to version 19.2.8. Update GitLab CE/EE versions 19.3 through 19.3.4 to version 19.3.5. Update GitLab CE/EE versions 19.4 through 19.4.1 to version 19.4.2.