Introduction
A stored Cross-site Scripting vulnerability in GitLab Enterprise Edition's customizable analytics dashboards lets an authenticated developer plant JavaScript payloads that fire in other users' browser sessions. It carries a CVSS score of 8.7. For organizations that use GitLab EE's analytics features to track engineering metrics and compliance data, the flaw turns a shared dashboard into a delivery mechanism for session hijacking or data exfiltration.
Technical Information
Root Cause
CVE-2026-7377 is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). The vulnerability is in the customizable analytics dashboards feature of GitLab Enterprise Edition. User-controlled data flowing into the dashboard rendering pipeline was not adequately escaped or sanitized before it was written to the DOM. A specially crafted payload embedded in chart or dashboard configuration data could therefore survive the entire rendering pipeline and execute as live JavaScript when another user viewed the dashboard.
CVSS Breakdown
The CVSS 3.1 vector string is AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N, which breaks down as follows:
| Metric | Value | Meaning |
|---|---|---|
| Attack Vector | Network | Exploitable remotely |
| Attack Complexity | Low | No special conditions required |
| Privileges Required | Low | Authenticated user with developer role |
| User Interaction | Required | Victim must view the dashboard |
| Scope | Changed | Impact extends beyond the vulnerable component |
| Confidentiality | High | Full read access to victim's session context |
| Integrity | High | Ability to modify data in victim's session context |
| Availability | None | No denial of service component |
The vulnerable component is the analytics dashboard, but the impact lands in the victim's browser, which is a different security authority. That "Changed" scope is what pushes the score to 8.7.
Attack Flow
Based on the available advisory details, exploitation follows these steps:
- An attacker authenticates to a GitLab EE instance with at least developer role permissions.
- The attacker crafts a malicious JavaScript payload and embeds it in the configuration or data fields of a customizable analytics dashboard. The injection point lies in how charts and dashboards render data.
- Because the payload is stored in the dashboard configuration, it persists on the server. That makes this a stored (persistent) XSS rather than a reflected one.
- When any other authenticated user opens and views the compromised analytics dashboard, their browser renders the improperly sanitized input.
- The malicious JavaScript executes in the context of the victim's browser session. From there the attacker can steal session tokens, read sensitive page content, or perform actions on the victim's behalf.
The main limit on exploitation is user interaction, since the victim has to view the dashboard. Analytics dashboards are collaborative by nature, though, and teams commonly share them, so social engineering or passive exploitation is straightforward in practice.
Patch Information
GitLab fixed CVE-2026-7377 on May 13, 2026, with three coordinated patch releases for GitLab Enterprise Edition. The fix tightens the input sanitization applied to user-controlled data flowing into the Analytics Dashboard. Before the patch, specially crafted payloads in these customizable dashboards could survive the rendering pipeline and be injected directly into the DOM. After it, all user-supplied input bound for dashboard rendering passes through sanitization filters that neutralize script injection vectors before output.
The fix covers three release branches:
| Affected Range | Fixed Version |
|---|---|
| GitLab EE 18.7 through 18.9.6 | 18.9.7 |
| GitLab EE 18.10 through 18.10.5 | 18.10.6 |
| GitLab EE 18.11 through 18.11.2 | 18.11.3 |
GitLab.com (the SaaS offering) was already running the patched version when the release was announced, and GitLab Dedicated customers needed no manual action. Self-managed installations must upgrade to one of the fixed versions above. That applies to every deployment type: omnibus, source code, and helm charts.
The underlying security issue (GitLab work item #598497) and the original HackerOne report (#3659044, submitted by the researcher known as aphantom) are still confidential. Under GitLab's standard 30-day disclosure policy, GitLab will make the detailed issue public on its issue tracker approximately 30 days after the patch release, including the specific merge requests and code diffs that implement the sanitization fix.
Affected Systems and Versions
The vulnerability affects GitLab Enterprise Edition only. The affected version ranges are:
- GitLab EE versions 18.7 through 18.9.6 (fixed in 18.9.7)
- GitLab EE versions 18.10 through 18.10.5 (fixed in 18.10.6)
- GitLab EE versions 18.11 through 18.11.2 (fixed in 18.11.3)
The vulnerable configuration requires the customizable analytics dashboards feature to be accessible, and exploitation requires an authenticated user with at least developer role permissions.
GitLab.com (SaaS) and GitLab Dedicated instances are not affected, because they were already patched when the advisory was published.
Vendor Security History
Analytics dashboards appear to be a recurring attack surface for GitLab. In April 2026, GitLab patched another Cross-site Scripting issue in analytics dashboards, CVE-2026-4332, in the 18.10.3, 18.9.5, and 18.8.9 patch releases. Two XSS vulnerabilities in the same feature area within roughly a month suggest that the analytics rendering pipeline needs deeper review and focused threat modeling.
GitLab runs a mature security program that includes a well-established bug bounty program on HackerOne and a coordinated disclosure process. Researchers aphantom and joaxcar reported CVE-2026-7377 through that bug bounty program. GitLab has also signed the Secure by Design pledge.
References
- NVD Entry for CVE-2026-7377
- CVE Record: CVE-2026-7377
- GitLab Patch Release: 18.11.3, 18.10.6, 18.9.7
- GitLab Official Release Announcement
- GitLab Work Item #598497 (Confidential)
- HackerOne Report #3659044 (Confidential)
- VulDB Entry for CVE-2026-7377
- SecurityOnline Coverage: GitLab Security Update
- GitLab Coordinated Disclosure Process
- GitLab Secure by Design Pledge Progress
- GitLab Patch Release: 18.10.3 (CVE-2026-4332)
