PT-2026-93323 · Gitlab · Gitlab Ce/Ee

Lucvs

·

CVE-2026-19619

·

Published

2026-09-16

·

Updated

2026-09-25

CVSS v3.1

4.7

Medium

VectorAV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 19.0 through 19.1.7 GitLab CE/EE versions 19.2 through 19.2.5 GitLab CE/EE versions 19.3 through 19.3.1
Description Improper sanitization of pasted HTML content in the Content Editor could allow an unauthenticated user to execute arbitrary JavaScript within the session of a targeted user.
Recommendations Update GitLab CE/EE versions 19.0 through 19.1.7 to version 19.1.8. Update GitLab CE/EE versions 19.2 through 19.2.5 to version 19.2.6. Update GitLab CE/EE versions 19.3 through 19.3.1 to version 19.3.2.

Exploit

Fix

XSS

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-79

Related Identifiers

BIT-GITLAB-2026-19619
CVE-2026-19619

Affected Products

Gitlab Ce/Ee