CVE-2026-19619 Overview
GitLab has patched a stored cross-site scripting (XSS) vulnerability in GitLab Community Edition (CE) and Enterprise Edition (EE). The flaw affects all versions from 19.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2. The Content Editor fails to properly sanitize pasted HTML content, allowing an unauthenticated attacker to execute arbitrary JavaScript in the context of a targeted user's session. Successful exploitation requires user interaction and specific preconditions, as reflected in the vulnerability's attack complexity rating. The issue is tracked as [CWE-79] and was disclosed through HackerOne report #3808840.
Critical Impact
Arbitrary JavaScript execution in a victim's authenticated GitLab session, enabling session-context actions and limited data exposure across a changed scope.
Affected Products
- GitLab CE/EE versions 19.0 through 19.1.7
- GitLab CE/EE versions 19.2 through 19.2.5
- GitLab CE/EE versions 19.3 through 19.3.1
Discovery Timeline
- 2026-09-16 - CVE-2026-19619 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-19619
Vulnerability Analysis
The vulnerability is a stored cross-site scripting flaw in GitLab's Content Editor, the rich-text editor used across issues, merge requests, wikis, and other Markdown-enabled surfaces. When a user pastes HTML content into the editor, the sanitization routine fails to strip or neutralize attacker-controlled markup that carries executable JavaScript. When a victim later renders the affected content, the browser executes the injected script under the victim's origin.
Exploitation runs in the context of the targeted user's session, meaning the script inherits the victim's authentication state and CSRF token access. The changed scope indicated by the vector reflects that injected code executes across trust boundaries within the browser, not just the vulnerable component.
Root Cause
The root cause is improper neutralization of input during web page generation [CWE-79] within the Content Editor's paste handler. Sanitization logic does not adequately filter HTML elements, attributes, or event handlers introduced through clipboard input before persisting or rendering them.
Attack Vector
An attacker crafts HTML content containing embedded JavaScript, then delivers it to a victim who pastes it into the GitLab Content Editor, or plants it in a resource the victim later renders. The attack is unauthenticated on the delivery side but requires the victim to interact with the malicious content. The high attack complexity reflects the specific conditions required to bypass existing sanitization.
Refer to the HackerOne Report #3808840 and GitLab Work Item #612792 for the technical proof-of-concept details.
Detection Methods for CVE-2026-19619
Indicators of Compromise
- Issue, merge request, wiki, or comment content containing unexpected <script>, <iframe>, or event-handler attributes such as onerror, onload, or onmouseover.
- Outbound requests from user browsers to unfamiliar domains immediately after opening GitLab pages containing user-submitted content.
- Unexpected session actions such as personal access token creation, SSH key uploads, or repository visibility changes performed by legitimate accounts.
Detection Strategies
- Audit notes, descriptions, and wiki_pages tables for HTML tags and event-handler attributes that should have been sanitized during rendering.
- Deploy a Content Security Policy (CSP) report-only endpoint and monitor violations that originate from gitlab.example.com document contexts.
- Correlate GitLab audit events (token creation, key changes, permission modifications) with the accessing browser session and referring page URL.
Monitoring Recommendations
- Forward GitLab application, audit, and web server logs to a centralized SIEM and alert on anomalous administrative actions following the viewing of user-generated content.
- Track User-Agent and IP address deltas across a single session token to identify session actions inconsistent with the authenticated user.
- Monitor personal access token (PAT) and OAuth grant creation velocity for spikes correlated with unpatched instances.
How to Mitigate CVE-2026-19619
Immediate Actions Required
- Upgrade self-managed GitLab CE/EE to 19.1.8, 19.2.6, or 19.3.2 depending on the deployed release train.
- Rotate personal access tokens, session cookies, and OAuth grants for any user who interacted with untrusted content on an unpatched instance.
- Review audit logs for suspicious token creation, SSH key additions, or permission changes since the vulnerable versions were deployed.
Patch Information
GitLab addressed the issue in versions 19.1.8, 19.2.6, and 19.3.2. See the GitLab Patch Release 19.3.2 advisory for upgrade guidance. GitLab.com SaaS is already running the patched release.
Workarounds
- No official workaround has been published; upgrading is the supported remediation path.
- Restrict untrusted user access to Content Editor surfaces on unpatched instances until the upgrade is applied.
- Enforce a strict Content Security Policy that disallows inline scripts to reduce the impact of script injection while patching is in progress.
# Configuration example: upgrade GitLab on Omnibus (Debian/Ubuntu)
sudo apt-get update
sudo apt-get install --only-upgrade gitlab-ee=19.3.2-ee.0
sudo gitlab-ctl reconfigure
sudo gitlab-ctl restart
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
