Loading vulnerability…
Stored XSS in GitLab EE Analytics Dashboard Chart Rendering
CVE-2026-7481 is a stored cross-site scripting vulnerability in GitLab Enterprise Edition affecting Analytics dashboard chart rendering. GitLab EE improperly sanitizes user-controlled chart configuration data before rendering it into page content, allowing a developer-role authenticated user to persist malicious JavaScript that executes in the browsers of other users who view the affected dashboard. The issue affects GitLab EE versions 16.4 through before 18.9.7, 18.10 through before 18.10.6, and 18.11 through before 18.11.3. The flaw is a persistent client-side injection condition caused by improper neutralization of input during web page generation.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows arbitrary JavaScript execution in the victim user's browser within the security context of the GitLab application. This can expose sensitive session data, enable unauthorized actions through the victim's authenticated session, and facilitate session hijacking, data exfiltration, or privilege escalation if a higher-privileged user views the malicious dashboard. Reported CVSS v3.1 characteristics indicate high confidentiality and integrity impact with changed scope, and no direct availability impact.
If you can’t patch tonight, do this now.
If immediate upgrade is not possible, restrict access to Analytics dashboard creation and modification to highly trusted users, closely review developer-role access assignments, and limit exposure of dashboards to privileged users until patched. Monitor for suspicious dashboard content and unexpected client-side behavior in Analytics views. These measures only reduce exposure and do not fully remediate the vulnerability.
Patch, then assume compromise.
Upgrade self-managed GitLab Enterprise Edition instances to a fixed release: 18.9.7, 18.10.6, or 18.11.3 or later, depending on the deployed release track. The vendor fix introduces proper sanitization of user-controlled values before they reach the Analytics dashboard chart rendering layer. GitLab-hosted services were already patched at disclosure time.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.