CVE-2026-15217: GitLab CE/EE XSS Vulnerability

CVE-2026-15217 Overview

CVE-2026-15217 is a stored cross-site scripting (XSS) vulnerability affecting GitLab Community Edition (CE) and Enterprise Edition (EE). The flaw resides in an analytics dashboard component that renders user-controlled values inside table cells without proper neutralization. An authenticated attacker with low privileges can inject script payloads that execute in another user's browser session when the victim views the affected dashboard. Successful exploitation compromises the confidentiality and integrity of the victim's GitLab session, including access to source code, pipelines, and administrative functions available to the impersonated user. GitLab has issued patches across the 19.0.x, 19.1.x, and 19.2.x release branches.

Critical Impact
A low-privileged authenticated attacker can execute arbitrary JavaScript in a victim's browser context, enabling session hijacking, credential theft, and unauthorized actions against GitLab projects and repositories.

Affected Products

GitLab CE/EE versions 18.2 up to (but not including) 19.0.6
GitLab CE/EE versions 19.1 up to (but not including) 19.1.4
GitLab CE/EE versions 19.2 up to (but not including) 19.2.2

Discovery Timeline

2026-08-12 - CVE-2026-15217 published to the National Vulnerability Database (NVD)
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-15217

Vulnerability Analysis

CVE-2026-15217 is a stored cross-site scripting flaw categorized under [CWE-79] (Improper Neutralization of Input During Web Page Generation). The vulnerable code path exists in an analytics dashboard component that renders table cell content. GitLab's front-end fails to escape or sanitize user-supplied values before inserting them into the DOM, allowing HTML and JavaScript payloads to render as active markup.

Exploitation requires an authenticated attacker with sufficient privileges to submit input that reaches the analytics dashboard. The payload executes when a second user, potentially a project maintainer or administrator, views the dashboard containing the injected data. Because the scope is changed (S:C in the CVSS vector), the impact extends beyond the vulnerable component to other browser origins the victim can access within the GitLab application.

Root Cause

The root cause is improper neutralization of user-controlled values rendered in table cell content by an analytics dashboard component. The rendering layer trusts input that should be treated as untrusted string data. Instead of encoding characters such as <, >, and " before writing to the page, the component emits raw values that the browser parses as HTML.

Attack Vector

The attack is network-accessible and requires user interaction. An attacker with a low-privileged GitLab account injects a crafted string into a field consumed by the analytics dashboard. When a privileged user loads the dashboard, the browser parses the injected markup and executes the attacker's script under the victim's session context. Refer to the HackerOne Security Report #3830478 and the GitLab Work Item Overview for additional context.

Detection Methods for CVE-2026-15217

Indicators of Compromise

Unexpected <script>, <img onerror=>, or javascript: payloads stored in analytics dashboard data sources
Outbound HTTP requests from user browsers to unfamiliar domains immediately after loading GitLab analytics pages
Anomalous API calls originating from authenticated GitLab sessions, such as personal access token creation or SSH key additions without user intent

Detection Strategies

Review GitLab audit logs for suspicious edits to fields feeding the analytics dashboard by low-privileged accounts
Inspect Content Security Policy (CSP) violation reports for inline script executions on GitLab dashboard routes
Search stored dashboard data for HTML metacharacters and known XSS payload signatures

Monitoring Recommendations

Enable GitLab audit event streaming to a centralized log platform and alert on privilege changes following dashboard access
Monitor session activity for concurrent logins or session token reuse from unexpected IP addresses
Track browser telemetry from administrative workstations for unexpected script execution on GitLab origins

How to Mitigate CVE-2026-15217

Immediate Actions Required

Upgrade GitLab CE/EE to version 19.0.6, 19.1.4, or 19.2.2 depending on the deployed release branch
Rotate personal access tokens, session cookies, and SSH keys for any users who accessed analytics dashboards on vulnerable versions
Audit recently created accounts, tokens, and repository permissions for signs of unauthorized changes

Patch Information

GitLab released fixed versions 19.0.6, 19.1.4, and 19.2.2. Administrators should apply the patched releases as documented in the GitLab Patch Release Documentation. Self-managed GitLab instances should follow the standard upgrade path for their edition and installation method.

Workarounds

Restrict access to the affected analytics dashboard component to trusted users until the upgrade is completed
Enforce a strict Content Security Policy that blocks inline script execution on GitLab origins
Limit account creation and reduce Developer-or-higher role assignments to minimize the pool of potential attackers

bash

# Example: verify GitLab version after upgrade
sudo gitlab-rake gitlab:env:info | grep "GitLab information" -A 5

# Example: enforce stricter CSP in gitlab.rb (self-managed)
# /etc/gitlab/gitlab.rb
gitlab_rails['content_security_policy'] = {
  enabled: true,
  report_only: false,
  directives: {
    "default_src" => "'self'",
    "script_src" => "'self'",
    "style_src"  => "'self' 'unsafe-inline'"
  }
}

# Apply the configuration
sudo gitlab-ctl reconfigure