Loading vulnerability…
XSS in GitLab Web IDE workbench asset handler
CVE-2026-10712 is a high-severity cross-site scripting vulnerability in GitLab Community Edition and Enterprise Edition. It affects versions 18.10 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1. The flaw is described as an issue in the Web IDE workbench asset handler where improper path validation under certain conditions can result in improper neutralization of attacker-controlled input during web page generation. A remote, unauthenticated attacker can exploit the issue to cause arbitrary JavaScript to execute in a victim user’s browser session.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation enables execution of arbitrary JavaScript in the context of a victim user’s browser session. This can lead to theft or misuse of session context, unauthorized actions performed as the victim within GitLab, manipulation of rendered content, and exposure of data accessible to the affected user. The vulnerability is remotely exploitable and can cross privilege boundaries because the attacker does not need to be authenticated while the script executes in another user’s session.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure of the vulnerable Web IDE functionality where operationally feasible, review and harden path validation controls around asset handling, and monitor for suspicious client-side activity involving the Web IDE. Review user session security controls and apply standard browser-session protections, but these measures are compensating controls only and do not replace upgrading to a fixed version.
Patch, then assume compromise.
Upgrade GitLab CE/EE to a fixed release. The patched versions are 18.11.6 or later in the 18.11 release line, 19.0.3 or later in the 19.0 release line, and 19.1.1 or later in the 19.1 release line. Self-managed deployments should be updated immediately to one of these fixed versions.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.