PT-2026-31546 · Gitlab · Gitlab Ce/Ee

Published 2026-04-08 · Updated 2026-04-13 · CVE-2026-4332

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions GitLab EE versions 18.2 through 18.8.8, 18.9 through 18.9.4, and 18.10 through 18.10.2

Description GitLab EE versions are susceptible to a flaw in customizable analytics dashboards. An authenticated user could potentially execute arbitrary JavaScript in the context of other users' browsers due to insufficient input sanitization.

Recommendations Update to GitLab EE version 18.8.9 or later. Update to GitLab EE version 18.9.5 or later. Update to GitLab EE version 18.10.3 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2026-05152

BIT-GITLAB-2026-4332

CVE-2026-4332

Affected Products

Gitlab Ce/Ee

References · 11

• 🔥 https://hackerone.com/reports/3600345 · Exploit
• https://cve.org/CVERecord?id=CVE-2026-4332 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-4332 · Security Note
• https://about.gitlab.com/releases/2026/04/08/patch-release-gitlab-18-10-3-released · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-4332 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-4332 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-gitlab-2026-4332 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-05152 · Security Note
• https://twitter.com/CVEnew/status/2042010551253885295 · Twitter Post
• https://twitter.com/infoflowcloud/status/2042012804203344171 · Twitter Post
• https://gitlab.com/gitlab-org/gitlab/-/work_items/593853 · Note