CVE-2026-84739: GitLab CE/EE XSS Vulnerability

CVE-2026-84739 Overview

CVE-2026-84739 is a stored cross-site scripting (XSS) vulnerability [CWE-79] in GitLab Community Edition (CE) and Enterprise Edition (EE). The flaw exists in the merge request diff viewer, where GitLab fails to properly sanitize path components. An authenticated user can inject arbitrary JavaScript that executes in the browser session of another user viewing the affected merge request. GitLab addressed the issue in versions 19.2.7, 19.3.3, and 19.4.1.

Critical Impact
An authenticated attacker can execute arbitrary JavaScript in a victim's browser context, enabling session hijacking, credential theft, and unauthorized actions against the GitLab instance.

Affected Products

GitLab CE/EE versions 13.11 through 19.2.6
GitLab CE/EE versions 19.3 through 19.3.2
GitLab CE/EE versions 19.4 through 19.4.0

Discovery Timeline

2026-09-29 - CVE-2026-84739 published to the National Vulnerability Database
2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-84739

Vulnerability Analysis

The vulnerability resides in the merge request diff viewer component of GitLab CE/EE. The application processes file path components displayed in the diff view without applying adequate output encoding or sanitization. An authenticated user with permission to create branches or merge requests can craft file paths containing HTML or JavaScript payloads. When another user renders the affected merge request, the malicious payload executes in their browser session.

The issue is scoped as a changed-scope flaw, meaning the injected script can affect resources beyond the vulnerable component. Because GitLab session cookies and API tokens are accessible from the same origin, script execution can lead to full account compromise for the victim, including project maintainers and administrators.

Root Cause

The root cause is improper neutralization of input during web page generation in the diff viewer's rendering path for file names and directory components. The affected code path emits path segments into the DOM without applying HTML entity encoding or escaping context-sensitive characters such as <, >, and ".

Attack Vector

Exploitation requires network access to a target GitLab instance, low-privilege authenticated access, and a victim interaction such as opening or reviewing the crafted merge request. An attacker creates a branch or repository containing a file whose path includes an XSS payload, then opens a merge request. When a reviewer or maintainer opens the diff viewer, the injected script executes with the victim's session privileges.

See the GitLab Patch Release Note and the HackerOne Report #3938482 for additional technical context.

Detection Methods for CVE-2026-84739

Indicators of Compromise

Repository files or branches with path components containing HTML tags, <script> fragments, or JavaScript event handlers such as onerror= or onload=
Merge requests created by low-privilege or newly registered accounts targeting projects with senior reviewers
Unexpected outbound requests from reviewer browsers to attacker-controlled domains shortly after opening a merge request
Unauthorized personal access token creation or SSH key registration correlated with merge request review activity

Detection Strategies

Inspect GitLab production logs (production.log, api_json.log) for merge request creations referencing files whose paths contain angle brackets, quotes, or reserved HTML characters
Review Git object history and tree entries for filenames containing script-like tokens
Monitor GitLab audit events for privilege changes, token issuance, or repository modifications initiated by reviewers within minutes of viewing a diff

Monitoring Recommendations

Enable Content Security Policy (CSP) reporting and forward violation reports to a centralized log platform
Track anomalous session activity such as concurrent logins from distinct geographies for the same GitLab account
Alert on outbound network traffic from user browsers to newly registered or low-reputation domains following GitLab review workflows

How to Mitigate CVE-2026-84739

Immediate Actions Required

Upgrade GitLab CE/EE to version 19.4.1, 19.3.3, or 19.2.7 as applicable to your deployment branch
Audit recent merge requests and repository trees for suspicious filenames containing HTML or JavaScript syntax
Rotate personal access tokens, session cookies, and SSH keys for any account that reviewed a suspicious merge request prior to patching
Restrict project membership and merge request creation to trusted users on internet-exposed GitLab instances

Patch Information

GitLab released fixed versions 19.4.1, 19.3.3, and 19.2.7. Refer to the GitLab Patch Release Note and GitLab Work Item #627316 for release details and remediation guidance.

Workarounds

No official workaround is published; upgrading is the supported remediation path
Reduce exposure by disabling public project creation and enforcing branch protection rules that limit who can push files with arbitrary paths
Enforce a strict Content Security Policy that blocks inline script execution to reduce the impact of residual XSS vectors

bash

# Configuration example: upgrade GitLab on an Omnibus deployment
sudo apt-get update
sudo apt-get install gitlab-ee=19.4.1-ee.0
sudo gitlab-ctl reconfigure
sudo gitlab-rake gitlab:check SANITIZE=true