CVE-2026-10087

Name of the Vulnerable Software and Affected Versions GitLab EE versions 17.1 through 18.10.7 GitLab EE versions 18.11 through 18.11.4 GitLab EE versions 19.0 through 19.0.1

Description Improper input sanitization in the Analytics Dashboard allows an authenticated user with developer-role permissions to execute arbitrary client-side code, such as JavaScript, on behalf of a targeted user. This is a stored cross-site scripting (XSS) issue, where malicious scripts are permanently stored on the server and executed in the context of the victim's session.

Recommendations Update versions 17.1 through 18.10.7 to 18.10.8. Update versions 18.11 through 18.11.4 to 18.11.5. Update versions 19.0 through 19.0.1 to 19.0.2.