GitLab EE Analytics Dashboard Chart Rendering XSS

Successful exploitation allows attacker-controlled JavaScript to execute in the context of another user’s browser session within GitLab. Based on the provided content and CVSS vector, this can result in high confidentiality and integrity impact, including session hijacking, theft of tokens or other sensitive data accessible to the victim session, and actions performed in GitLab under the victim user’s context such as repository manipulation. No direct availability impact is indicated.

If immediate patching is not possible, reduce exposure by limiting access to affected GitLab instances to trusted users, especially accounts with developer-role permissions that can supply content rendered in analytics dashboards. Monitor for suspicious injected script content and unusual account activity consistent with session abuse or token theft. These are temporary risk-reduction measures only; the authoritative mitigation is to upgrade to a fixed version.

Upgrade GitLab EE to a fixed release. The provided content states that affected self-managed deployments should update to 18.9.7, 18.10.6, or 18.11.3 or later, depending on the supported upgrade path. GitLab cloud-hosted platforms were already patched according to the source material.