Loading vulnerability…
Cross-site scripting in GitLab EE vulnerability evidence table renderer
CVE-2026-6896 is a high-severity cross-site scripting vulnerability in GitLab Enterprise Edition affecting versions 13.11 through before 18.11.7, 19.0 through before 19.0.4, and 19.1 through before 19.1.2. The flaw is caused by improper sanitization of user-supplied input during web page generation in the vulnerability evidence table renderer. Under certain conditions, an authenticated user with Developer-role permissions can inject content that executes arbitrary script in another user’s browser session when the crafted content is rendered.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows attacker-controlled script execution in the victim user’s browser session within the GitLab application context. This can enable session hijacking, access to sensitive data visible to the victim, execution of unauthorized actions as the victim, and other integrity and confidentiality impacts associated with stored or rendered XSS. Available scoring information indicates high confidentiality and integrity impact with no direct availability impact.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure by limiting untrusted Developer-role access, restricting who can create or modify content that is rendered in the vulnerability evidence table, and monitoring for suspicious content injection or anomalous user-session activity. These measures are temporary risk-reduction steps and do not replace upgrading to a fixed version.
Patch, then assume compromise.
Upgrade GitLab EE to a fixed release. Patched versions are 18.11.7, 19.0.4, and 19.1.2. Self-managed deployments on affected versions should be updated immediately to the appropriate patched release in their supported upgrade path.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.