CVE-2026-92883

GitLab CE and EE have a stored cross-site scripting flaw (CWE-79) caused by improper sanitization of HTML attributes in syntax-highlighted output. An authenticated user can place a specially crafted repository that, when another user views it, runs arbitrary JavaScript in that user’s browser session. The attacker can compromise the victim’s session with high confidentiality and integrity impact; user interaction is required and availability is not affected. All GitLab CE/EE versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 are affected (CVSS 8.7 high). No public proof-of-concept is known and the issue is not in CISA KEV.

What to do: Upgrade self-managed GitLab CE/EE to 19.2.8, 19.3.5, or 19.4.2 (or a later release on that line). Until upgraded, limit who can push repositories and treat unexpected syntax-highlighted content as suspicious; gitlab.com is remediated by GitLab.