This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] GitLab fixes 8 vulnerabilities
GitLab fixes 8 vulnerabilities in GitLab Community Edition (CE) and GitLab Enterprise Edition (EE) with versions 19.1.2, 19.0.4, 18.11.7 [1]. The most severe vulnerabilities are listed below.
An authenticated remote attacker with developer permissions in GitLab EE can perform an XSS attack in the tool for rendering the vulnerability report table [1][2].
The vulnerability is present in product:
- GitLab EE; >=13.11, <18.11.7; >=19.0, <19.0.4; >=19.1, <19.1.2;
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
More information:
- CVE-2026-6896 at cve.org, NVD
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org
The vulnerability was publicly disclosed 8. 7. 2026.
An authenticated remote attacker with elevated privileges in GitLab CE/EE can perform an XSS attack when markup syntax is rendered [1][3].
The vulnerability is present in products:
- GitLab CE; >=15.7, <18.11.7; >=19.0, <19.0.4; >=19.1, <19.1.2;
- GitLab EE; >=15.7, <18.11.7; >=19.0, <19.0.4; >=19.1, <19.1.2;
CVSS: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N
More information:
- CVE-2026-13320 at cve.org, NVD
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org
The vulnerability was publicly disclosed 8. 7. 2026.
Links
By CESNET, z.s.p.o. Táňa Macháčková on 9. 7. 2026.