Introduction
A recently patched cross-site scripting flaw in GitLab Enterprise Edition's Duo Agent output rendering allowed any authenticated user to inject arbitrary JavaScript that would execute in the browsers of other users viewing the same content. The vulnerability carries a CVSS score of 8.7 and a "Changed" scope designation. It could compromise user sessions and expose data well beyond the immediate rendering surface, so any organization running self-managed GitLab EE instances should treat it as a priority patch.
Technical Information
Root Cause
CVE-2026-6073 is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). The vulnerability is in the Duo Agent output rendering path in GitLab Enterprise Edition. GitLab Duo is the platform's AI-powered assistant. The Duo Agent component generates and returns output, such as code suggestions, summaries, and workflow results, and that output is rendered directly in the browser for users to read.
The flaw is straightforward. The application failed to properly sanitize output generated by the Duo Agent before injecting it into the page. Because this output is rendered in the browser context of whoever views it, an attacker who could influence the content of Duo Agent output could embed arbitrary JavaScript payloads that would then execute when other users interacted with the rendered content.
Attack Flow
Exploitation follows this sequence:
- An authenticated attacker identifies that the Duo Agent output rendering surface accepts unsanitized input.
- The attacker crafts a malicious payload containing arbitrary JavaScript and introduces it through a vector that influences Duo Agent output.
- The malicious output is stored or reflected through the GitLab EE interface.
- When another authenticated user views the page containing the rendered Duo Agent output, the injected JavaScript executes in their browser context.
- The attacker's script can then access the victim's session tokens, perform actions on their behalf, or exfiltrate data accessible within the victim's browser session.
CVSS Breakdown
The CNA-assigned CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N, yielding a score of 8.7 (High).
| Metric | Value | Rationale |
|---|---|---|
| Attack Vector | Network | Exploitable over the network |
| Attack Complexity | Low | No advanced conditions required |
| Privileges Required | Low | Attacker must be authenticated |
| User Interaction | Required | Victim must view the malicious output |
| Scope | Changed | Impact extends beyond the vulnerable component |
| Confidentiality | High | Session data and user information at risk |
| Integrity | High | Attacker can perform actions as the victim |
| Availability | None | No direct availability impact |
The "Scope: Changed" metric is what sets this vulnerability apart. It means successful exploitation crosses a trust boundary. The attacker compromises the Duo Agent rendering component, but the impact lands in the victim's browser session, where it can potentially reach other systems and data the victim has access to.
Feature Introduction Timeline
GitLab introduced the Duo Agent output rendering feature in GitLab EE version 18.7. The vulnerability has been present in every release from 18.7 onward through the unpatched branches, which left the unsanitized rendering surface exposed for a window of several months.
Patch Information
GitLab fixed CVE-2026-6073 in a coordinated security patch release published on May 13, 2026. Fixed versions shipped for all three active release branches:
| Current Branch | Fixed Version |
|---|---|
| 18.7 through 18.9.6 | 18.9.7 |
| 18.10 through 18.10.5 | 18.10.6 |
| 18.11 through 18.11.2 | 18.11.3 |
GitLab.com was already running the patched version at the time of disclosure, and GitLab Dedicated customers needed to take no action. Self-managed GitLab EE administrators should upgrade to one of the patched versions immediately.
The fix improves sanitization of content the Duo Agent returns before the UI renders it. With the agent's output properly escaped or filtered, the browser no longer interprets injected scripts as executable code. That closes the stored or reflected XSS vector the unsanitized rendering surface exposed.
Security researcher joaxcar reported the vulnerability through GitLab's HackerOne bug bounty program. The associated GitLab work item (#596340) remains confidential under GitLab's standard 30-day disclosure policy and is expected to be made public approximately 30 days after the patch release.
The same patches fix more than this one flaw. The May 2026 security update also addresses other high-severity issues, including unauthenticated denial-of-service vulnerabilities and further sanitization gaps in the Banzai markdown sanitizer.
Affected Systems and Versions
This vulnerability is specific to GitLab Enterprise Edition and does not affect the Community Edition.
| Product | Affected Version Range | Fixed Version |
|---|---|---|
| GitLab EE | 18.7 through 18.9.6 | 18.9.7 |
| GitLab EE | 18.10 through 18.10.5 | 18.10.6 |
| GitLab EE | 18.11 through 18.11.2 | 18.11.3 |
The affected range starts at 18.7, the version that introduced the Duo Agent output rendering feature. All later releases through the unpatched branches are vulnerable. GitLab.com (the SaaS offering) and GitLab Dedicated instances were patched at the time of disclosure and are not at risk.
Vendor Security History
GitLab has a mature security program, including an active bug bounty program on HackerOne. Its handling of CVE-2026-6073 matched its established disclosure practices. It released patches across multiple version branches at the same time, gave a clear rationale for its CVSS scoring in the security advisory, and kept the work item confidential under its standard 30-day disclosure policy. The May 2026 patch release fixed multiple vulnerabilities in one coordinated update, including this XSS flaw and the unauthenticated denial-of-service issues.
