GitLab EE CVE-2026-7481: Brief Summary of a High Severity Stored XSS in Analytics Dashboard Charts

Introduction

A stored Cross-Site Scripting flaw in GitLab Enterprise Edition's Analytics dashboard chart rendering allowed any authenticated developer to plant JavaScript payloads that would fire in the browsers of colleagues viewing the same dashboard. CVE-2026-7481 has a CVSS 3.1 score of 8.7, and its scope change puts the confidentiality and integrity of the victim's session at risk. Administrators of self-managed GitLab instances should patch it without delay.

Technical Information

Root Cause

The vulnerability is an instance of CWE-79: Improper Neutralization of Input During Web Page Generation. In GitLab EE's Analytics dashboard, chart configurations accept user-controlled input. That input flows into the chart rendering pipeline and from there into the HTML served to any user who views the dashboard. The application did not sanitize these values before rendering them, which left a classic stored XSS injection point.

Because the payload is stored server-side (in the chart configuration) and rendered to every subsequent viewer, this is a stored (persistent) XSS rather than a reflected one. Persistence makes the impact considerably worse. The attacker does not need to trick each victim into clicking a crafted link. They modify a dashboard chart, and every user who opens that Analytics page becomes a target.

CVSS 3.1 Breakdown

The assigned vector is AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N, which breaks down as follows:

Scope: Changed means the vulnerable component (GitLab's server-side rendering) and the impacted component (the victim's browser session) are distinct security authorities. A successful exploit compromises the confidentiality and integrity of the victim's authenticated session. That may enable session hijacking, data exfiltration, or privilege escalation if the victim holds a higher role than the attacker.

Attack Flow

Based on the available advisory information, exploitation follows this sequence:

1. The attacker authenticates to a GitLab EE instance with at least developer-role permissions on a project or group.
2. The attacker opens the Analytics dashboard and modifies a chart configuration, injecting a JavaScript payload into a field that is not properly sanitized.
3. GitLab saves the malicious chart configuration server-side.
4. When another user (potentially an administrator or maintainer) views the same Analytics dashboard, the chart rendering pipeline writes the attacker's payload directly into the page HTML.
5. The victim's browser executes the injected JavaScript within the context of their authenticated GitLab session.
6. The attacker's script can then, for example, steal session cookies, make API calls on behalf of the victim, or exfiltrate sensitive repository and pipeline data.

The insecure code path dates back to GitLab EE version 16.4, so this injection vector was present for roughly two years before it was fixed.

Patch Information

GitLab fixed CVE-2026-7481 in a coordinated security patch release published on May 13, 2026, with fixed versions on three release branches:

The fix sanitizes user-controlled values before they reach the chart rendering layer, which closes the injection vector. This follows GitLab's standard backporting approach. GitLab patches the current stable branch first, then backports the fix to the two previous minor releases.

GitLab.com (the SaaS offering) was already running the patched version when the release was announced. GitLab Dedicated customers did not need to take any manual action. Self-managed installations, however, must upgrade to one of the fixed versions listed above.

The specific source-level code changes (diffs, commits) are not yet publicly visible. GitLab's security policy makes vulnerability issue details and associated merge requests public on its issue tracker 30 days after the patch release. The internal tracking work item (gitlab-org/gitlab#598646) and the corresponding HackerOne report (#3697379, reported by researcher yvvdwf) are both currently restricted. Full technical disclosure is expected around mid-June 2026.

Affected Systems and Versions

The vulnerability affects GitLab Enterprise Edition only. The following version ranges are confirmed vulnerable:

• All GitLab EE versions from 16.4 up to (but not including) 18.9.7
• GitLab EE versions 18.10 up to (but not including) 18.10.6
• GitLab EE versions 18.11 up to (but not including) 18.11.3

The advisory does not list GitLab Community Edition as affected. GitLab.com (SaaS) has already been patched. GitLab Dedicated instances did not require manual intervention.

Vendor Security History

GitLab has a mature and transparent security program. It runs a public bug bounty program on HackerOne, which is how CVE-2026-7481 was responsibly reported. GitLab is also a CVE Numbering Authority (CNA) and issues its own CVE identifiers for vulnerabilities in its products. Its coordinated disclosure process keeps vulnerability details restricted on the GitLab issue tracker for 30 days after a patch ships, so customers have time to upgrade before full technical details become public. That level of process is what you would expect from a company whose platform handles CI/CD pipelines and source code management for a large segment of the software industry.

References

• NVD: CVE-2026-7481
• CVE Record: CVE-2026-7481
• GitLab Patch Release: 18.11.3, 18.10.6, 18.9.7
• GitLab Official Release Announcement
• GitLab Work Item #598646 (restricted)
• HackerOne Report #3697379 (restricted)
• GitHub Advisory: GHSA-4qfp-7g23-rwjx
• SecurityOnline: GitLab Security Update
• GitLab Coordinated Disclosure Policy