PT-2026-40876 · Gitlab · Gitlab Ce/Ee+1

Published 2026-05-13 · Updated 2026-05-18 · CVE-2026-7377

Positive Technologies (AI Summary)

CVSS v3.1

8.7

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions GitLab EE versions 18.7 through 18.9.6 GitLab EE versions 18.10 through 18.10.5 GitLab EE versions 18.11 through 18.11.2

Description An issue in customizable analytics dashboards allows an authenticated user to execute arbitrary JavaScript in the context of other users' browsers. This occurs due to improper input sanitization, leading to stored Cross-site Scripting (XSS), where malicious scripts are injected into the dashboard and executed when viewed by other users. Over 1.2 million instances are identified globally.

Recommendations Update versions 18.7 through 18.9.6 to 18.9.7. Update versions 18.10 through 18.10.5 to 18.10.6. Update versions 18.11 through 18.11.2 to 18.11.3.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2026-06813

BIT-GITLAB-2026-7377

CVE-2026-7377

Affected Products

Gitlab

Gitlab Ce/Ee

References · 17

• 🔥 https://hackerone.com/reports/3659044 · Exploit
• https://osv.dev/vulnerability/BIT-gitlab-2026-7377 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-7377 · Security Note
• https://ubuntu.com/security/CVE-2026-7377 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-7377 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-7377 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-06813 · Security Note
• https://github.com/advisories/GHSA-cv3h-4g8c-4vw6 · Note
• https://docs.gitlab.com/releases/patches/patch-release-gitlab-18-11-3-released · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-7377 · Note
• https://reddit.com/r/pwnhub/comments/1tcxwg4/critical_xss_vulnerability_discovered_in_gitlab · Reddit Post
• https://about.gitlab.com/releases/2026/05/13/patch-release-gitlab-18-11-3-released · Note
• https://t.me/CVEtracker/53747 · Telegram Post
• https://gitlab.com/gitlab-org/gitlab/-/work_items/598497 · Note
• https://twitter.com/zoomeye_team/status/2054817017774088570 · Twitter Post