Loading vulnerability…
Cross-site Scripting in GitLab EE Analytics Dashboard
CVE-2026-10086 is a high-severity cross-site scripting vulnerability in the Analytics Dashboard component of GitLab Enterprise Edition. The issue is caused by improper sanitization of user-supplied input during web page generation, which can allow attacker-controlled content to be rendered and executed in a victim’s browser. Under certain conditions, an authenticated user with developer-role permissions can trigger arbitrary client-side code execution in the context of another user’s session. The vulnerability affects GitLab EE versions 16.4 through before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows execution of arbitrary JavaScript or other client-side code in the victim user’s browser session within the GitLab application context. This can enable session compromise, unauthorized actions performed as the victim, access to sensitive data visible to that user, interface manipulation, and other integrity and confidentiality impacts associated with stored or triggered cross-site scripting in a privileged web application context.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure by limiting access to affected GitLab instances, restricting developer-role assignment to trusted users only, and closely monitoring for suspicious content or activity in the Analytics Dashboard. Because exploitation requires authenticated developer-level access and user interaction in a browser context, minimizing untrusted user access and reviewing dashboard-rendered content can reduce risk, but these measures are not a substitute for upgrading.
Patch, then assume compromise.
Upgrade GitLab Enterprise Edition to a fixed release. Patched versions include 18.11.6, 19.0.3, and 19.1.1 or later, depending on the deployed release train. Self-managed deployments should apply the vendor-provided security updates as soon as possible.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.