PT-2026-40878 · Gitlab · Gitlab Ce/Ee

Published 2026-05-14 · Updated 2026-05-15 · CVE-2026-7481

Positive Technologies (AI Summary)

CVSS v3.1

8.7

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions GitLab EE versions 16.4 through 18.9.6 GitLab EE versions 18.10 through 18.10.5 GitLab EE versions 18.11 through 18.11.2

Description Improper input sanitization allows an authenticated user with developer-role permissions to execute arbitrary JavaScript in the browsers of other users. This is a Cross-Site Scripting (XSS) issue, where malicious scripts are injected into trusted websites.

Recommendations Update to version 18.9.7 Update to version 18.10.6 Update to version 18.11.3

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2026-06917

BIT-GITLAB-2026-7481

CVE-2026-7481

Affected Products

Gitlab Ce/Ee

References · 11

• 🔥 https://hackerone.com/reports/3697379 · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-7481 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-gitlab-2026-7481 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-7481 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-7481 · Security Note
• https://bdu.fstec.ru/vul/2026-06917 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-7481 · Security Note
• https://gitlab.com/gitlab-org/gitlab/-/work_items/598646 · Note
• https://twitter.com/UpwindMDR/status/2054844718043758599 · Twitter Post
• https://about.gitlab.com/releases/2026/05/13/patch-release-gitlab-18-11-3-released · Note
• https://t.me/CVEtracker/53749 · Telegram Post