CVE-2026-15217

Analyzed Analyzed - Analysis Complete

Cross-Site Scripting in GitLab CE/EE Analytics Dashboard

Publication date: 2026-08-12

Last updated on: 2026-08-19

Assigner: GitLab Inc.

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed cross-site scripting due to improper neutralization of user-controlled values rendered in table cell content by an analytics dashboard component.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-19

Generated

2026-09-02

AI Q&A

2026-08-13

EPSS Evaluated

2026-08-31

NVD

CVE-2026-15217

EUVD

EUVD-2026-57438

Affected Vendors & Products

Vendor	Product	Version / Range
gitlab	gitlab	From 19.1.0 (inc) to 19.1.4 (exc)
gitlab	gitlab	From 19.2.0 (inc) to 19.2.2 (exc)
gitlab	gitlab	From 19.2.0 (inc) to 19.2.2 (exc)
gitlab	gitlab	From 18.2.0 (inc) to 19.0.6 (exc)
gitlab	gitlab	From 19.1.0 (inc) to 19.1.4 (exc)
gitlab	gitlab	From 18.2.0 (inc) to 19.0.6 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability is a cross-site scripting (XSS) issue in GitLab CE/EE. It affects versions from 18.2 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2. The flaw occurs due to improper neutralization of user-controlled values in an analytics dashboard component, which renders them in table cell content.

Detection Guidance

This vulnerability is specific to GitLab versions before 19.0.6, 19.1.4, and 19.2.2. To detect it, check your GitLab version using the command: gitlab-rake gitlab:env:info. If your version is below the patched releases, the system is vulnerable.

Impact Analysis

An attacker could exploit this to inject malicious scripts into web pages viewed by users. This could lead to unauthorized actions on behalf of users, data theft, or session hijacking if the user has elevated privileges.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements. Organizations may face compliance penalties if exploited.

Mitigation Strategies

Immediately upgrade GitLab to a patched version: 19.0.6, 19.1.4, or 19.2.2 or later. If upgrading is not possible, restrict access to the affected analytics dashboard component or disable it temporarily until the upgrade is completed.

Hi! I’m here to help you understand CVE-2026-15217. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70