CVE-2026-6073
Description
GitLab has remediated an issue in GitLab EE affecting all versions from 18.7 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user to execute arbitrary JavaScript in other users' browsers due to improper input sanitization.
Summary dbcve.org
This is a stored Cross-Site Scripting (XSS) vulnerability in GitLab EE where an authenticated user can inject malicious JavaScript code that executes in other users' browsers due to improper input sanitization. The vulnerability affects GitLab EE versions 18.7 through 18.11.2, with patches available in versions 18.9.7, 18.10.6, and 18.11.3.
Mitigation
Upgrade GitLab EE to version 18.9.7, 18.10.6, 18.11.3 or later to remediate the XSS vulnerability. Maintainers should also review other input sanitization points in the application as a defensive measure.