CVE-2026-19619

CVE-2026-19619 is a cross-site scripting flaw (CWE-79) in the Content Editor of GitLab Community Edition and Enterprise Edition, caused by improper sanitization of pasted HTML content. Under certain conditions, an unauthenticated attacker can inject HTML that, once processed in a targeted user's Content Editor session, executes arbitrary JavaScript in the context of that user's session. Per the CVSS vector, the attack requires user interaction and has high attack complexity, yielding low confidentiality and integrity impact in a changed security scope (the script runs in the victim's session). All GitLab CE/EE deployments running versions 19.0 prior to 19.1.8, 19.2 prior to 19.2.6, or 19.3 prior to 19.3.2 are affected. There is currently no evidence of in-the-wild exploitation, no CISA KEV listing, and no known public proof-of-concept.

What to do: Upgrade GitLab CE/EE to 19.1.8, 19.2.6, or 19.3.2 (or later) depending on your release branch. Until patched, exercise caution with unsolicited or untrusted content pasted into the Content Editor, since exploitation requires user interaction. After upgrading, review session and Content Editor activity logs for signs of unexpected script execution, and note that no public PoC or KEV listing exists at this time.