PT-2026-40872 · Gitlab · Gitlab Ce/Ee

Published 2026-05-14 · Updated 2026-05-18 · CVE-2026-6073

Positive Technologies (AI Summary)

CVSS v3.1

8.7

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions GitLab EE versions 18.7 through 18.9.6 GitLab EE versions 18.10 through 18.10.5 GitLab EE versions 18.11 through 18.11.2

Description An issue exists where improper input sanitization allows an authenticated user to execute arbitrary JavaScript in other users' browsers. This Cross-Site Scripting (XSS) flaw—a vulnerability where malicious scripts are injected into otherwise trusted websites—can lead to session hijacking, page defacement, or redirection to harmful sites.

Recommendations Update versions 18.7 through 18.9.6 to 18.9.7. Update versions 18.10 through 18.10.5 to 18.10.6. Update versions 18.11 through 18.11.2 to 18.11.3.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2026-06916

BIT-GITLAB-2026-6073

CVE-2026-6073

Affected Products

Gitlab Ce/Ee

References · 13

• 🔥 https://hackerone.com/reports/3655677 · Exploit
• https://osv.dev/vulnerability/BIT-gitlab-2026-6073 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-06916 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-6073 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-6073 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-6073 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-6073 · Vendor Advisory
• https://reddit.com/r/pwnhub/comments/1tcxw6x/critical_xss_vulnerability_found_in_gitlab_ee · Reddit Post
• https://gitlab.com/gitlab-org/gitlab/-/work_items/596340 · Note
• https://twitter.com/UpwindMDR/status/2054844718043758599 · Twitter Post
• https://docs.gitlab.com/releases · Note
• https://t.me/CVEtracker/53743 · Telegram Post
• https://about.gitlab.com/releases/2026/05/13/patch-release-gitlab-18-11-3-released · Note