CVE-2026-15216 PUBLISHED

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

Assigner: GitLab
Reserved: 09.07.2026 Published: 12.08.2026 Updated: 13.08.2026

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed cross-site scripting due to improper neutralization of user-controlled data rendered in pagination controls by an analytics dashboard component.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
CVSS Score: 8.7

Product Status

Vendor GitLab
Product GitLab
Versions Default: unaffected
  • affected from 18.2 to 19.0.6 (excl.)
  • affected from 19.1 to 19.1.4 (excl.)
  • affected from 19.2 to 19.2.2 (excl.)

Solutions

Upgrade to versions 19.0.6, 19.1.4, 19.2.2 or above.

Credits

  • Thanks [yvvdwf](https://hackerone.com/yvvdwf) for reporting this vulnerability through our HackerOne bug bounty program finder

References

Problem Types

  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE