CVE-2026-6896

Name of the Vulnerable Software and Affected Versions GitLab EE versions 13.11 through 18.11.6 GitLab EE versions 19.0 through 19.0.3 GitLab EE versions 19.1 through 19.1.1

Description An issue exists where improper sanitization of user-supplied input could allow an authenticated user with developer-role permissions to execute arbitrary scripts in another user's browser session. This is a cross-site scripting (XSS) flaw, which occurs when an application includes untrusted data in a web page without proper validation or encoding, allowing a malicious script to execute in the victim's browser.

Recommendations Update GitLab EE versions 13.11 through 18.11.6 to version 18.11.7. Update GitLab EE versions 19.0 through 19.0.3 to version 19.0.4. Update GitLab EE versions 19.1 through 19.1.1 to version 19.1.2.