Loading vulnerability…
Cross-site Scripting in GitLab EE Analytics Dashboard
CVE-2026-10087 is a cross-site scripting vulnerability in the Analytics Dashboard component of GitLab Enterprise Edition caused by improper input sanitization. It affects GitLab EE versions from 17.1 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2. Under certain conditions, an authenticated user with developer-role permissions can inject content that is later rendered in a targeted user’s browser, resulting in execution of arbitrary client-side code in the context of that user’s session. The vulnerability has been classified as CWE-79.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows arbitrary client-side code execution in the targeted user’s browser session within GitLab. This can enable theft of session data, execution of unauthorized actions as the victim, access to sensitive information available to the victim, and broader compromise associated with cross-site scripting in an application context with changed scope. Reported CVSS v3.1 vector information indicates high confidentiality and integrity impact with no direct availability impact.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure by limiting access to the affected Analytics Dashboard functionality to trusted users, especially users with developer-role permissions, and by minimizing opportunities for untrusted content to be introduced into dashboard-related inputs. Because this is a server-side sanitization flaw leading to client-side execution, mitigation is only partial; upgrading to a fixed version is the reliable corrective action.
Patch, then assume compromise.
Upgrade GitLab EE to a fixed release. Patched versions are 18.10.8, 18.11.5, and 19.0.2 or later, depending on the deployment branch. Self-managed installations running affected versions should be updated as soon as possible to a supported fixed version.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.