- Description
- GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.11 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary JavaScript in the context of another user's browser session due to improper sanitization of path components in the merge request diff viewer.
- Source
- cve@gitlab.com
- NVD status
- Analyzed
- Products
- gitlab
CVSS 3.1
- Type
- Secondary
- Base score
- 8.7
- Impact score
- 5.8
- Exploitability score
- 2.3
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
- Severity
- HIGH
- cve@gitlab.com
- CWE-79
- Hype score
- Not currently trending
Toutes nos instances GitLab sont à jour en version 19.4.1 depuis hier soir à 22h. Il faut mettre à jour rapidement : cette nouvelle version corrige 2 CVE évaluées à 9,9 (CVE-2026-93577 et CVE-2026-84739). En savoir plus sur nos offres 👇 https://t.co/YFPUqGvB0E
@bearstech
24 Sept 2026
5044 Impressions
2 Retweets
16 Likes
4 Bookmarks
1 Reply
1 Quote
GitLabに重大(Critical)な脆弱性が2件。CVE-2026-89078とCVE-2026-93577はCVSSスコア9.9で、それぞれ解放後メモリ使用と整数オーバーフローによる遠隔コード実行。ほか、クロスサイトスクリプティングのCVE-2026-84739と併せ
@__kokumoto
24 Sept 2026
696 Impressions
1 Retweet
4 Likes
3 Bookmarks
0 Replies
0 Quotes
[
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*",
"matchCriteriaId": "B199BC51-D1DC-495E-A300-24C57AA3FA26",
"versionEndExcluding": "19.2.7",
"versionStartIncluding": "13.11.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
"matchCriteriaId": "5BF72F7E-CA63-48DA-B22F-3F84A8832ED8",
"versionEndExcluding": "19.2.7",
"versionStartIncluding": "13.11.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*",
"matchCriteriaId": "053EF913-CD59-404C-8878-B42B122608DD",
"versionEndExcluding": "19.3.3",
"versionStartIncluding": "19.3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
"matchCriteriaId": "FDD16091-261D-4616-BF85-70CF011C6740",
"versionEndExcluding": "19.3.3",
"versionStartIncluding": "19.3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gitlab:gitlab:19.4.0:*:*:*:community:*:*:*",
"matchCriteriaId": "476CE485-460C-4EBE-AC16-D7AE6C30DF50",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gitlab:gitlab:19.4.0:*:*:*:enterprise:*:*:*",
"matchCriteriaId": "DED8DBAE-9FCD-40A4-9A9B-BAC26B4CBD44",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
]