CVE-2026-10086

Name of the Vulnerable Software and Affected Versions GitLab EE versions 16.4 through 18.11.5 GitLab EE versions 19.0 through 19.0.2 GitLab EE versions 19.1 through 19.1.0

Description Improper sanitization of user-supplied input allows an authenticated user with developer-role permissions to execute arbitrary client-side code within the session context of another user. This is a Cross-site Scripting (XSS) issue, which occurs when an application includes untrusted data in a web page without proper validation or encoding.

Recommendations Update to version 18.11.6 or later. Update to version 19.0.3 or later. Update to version 19.1.1 or later.