CVE-2026-13320: GitLab Cross-Site Scripting (XSS) in CE/EE – Patch Now

Technical summary

CVE-2026-13320 is a stored or reflected cross-site scripting vulnerability (CWE-79) in GitLab CE/EE stemming from improper input sanitization. The vulnerability chain requires: (1) an authenticated user with elevated privileges, (2) crafted malicious input submitted to an unfiltered parameter, and (3) a victim user rendering the payload in their browser within the same application context. The CVSS 3.1 score of 7.3 (HIGH) reflects the confidentiality and integrity impact across security boundaries (S:C), mitigated by the requirement for high privilege level (PR:H) and user interaction (UI:R).

Business impact

A compromised or malicious administrator could hijack sessions of other GitLab users, potentially extracting session tokens, stealing sensitive project data, or performing unauthorized actions on behalf of victims without leaving obvious logs. Organizations running multi-tenant or open-source GitLab instances where admin access is delegated face heightened risk, particularly if privileged accounts lack sufficient monitoring or access controls. The confidentiality and integrity impact extends beyond a single user to potentially compromise repository integrity and organizational trust.

Affected systems

The vulnerability impacts GitLab CE/EE across three version ranges: all instances from 15.7 up to (but not including) 18.11.7, all 19.0.x versions before 19.0.4, and all 19.1.x versions before 19.1.2. Self-managed GitLab deployments running any version within these ranges are affected; GitLab.com SaaS is not impacted as GitLab maintains control of updates. Users on 18.11.7+, 19.0.4+, or 19.1.2+ are unaffected.

Exploitability

Exploitation is not trivial. An attacker must possess valid GitLab credentials with administrative or moderator-equivalent privileges to inject the malicious input. Additionally, the victim must visit or interact with the poisoned content (UI:R in the CVSS vector), preventing fully automatic compromise. This gatekeeping reduces widespread attack likelihood but does not eliminate risk in scenarios involving compromised admin accounts, insider threats, or social engineering targeting high-privilege users. No public exploit code or active in-the-wild exploitation has been reported.

Remediation

GitLab has released patched versions addressing the input sanitization defect. Affected users should upgrade to one of the following minimum versions: 18.11.7, 19.0.4, or 19.1.2, depending on their current minor version track. Upgrading resets the vulnerable code path and prevents the injection vector. For organizations unable to patch immediately, review admin account access controls, enable multi-factor authentication on privileged accounts, and monitor for suspicious user-input submissions in audit logs.

Patch guidance

Apply the following security updates according to your current GitLab version: (1) If on 15.7–18.11.6: upgrade to 18.11.7 or later. (2) If on 19.0.0–19.0.3: upgrade to 19.0.4 or later. (3) If on 19.1.0–19.1.1: upgrade to 19.1.2 or later. Test patches in a non-production environment to verify compatibility with custom integrations or plugins. GitLab recommends scheduling patching during a maintenance window to minimize disruption. Consult the official GitLab security advisory for any version-specific migration notes or known issues.

Detection guidance

Hunt for anomalous admin activity by reviewing GitLab audit logs for unusual form submissions or API calls originating from privileged accounts, especially those containing script tags or HTML entities. Monitor web server logs (if exposed) for requests containing XSS payloads (e.g., <script>, javascript:, onerror=). Check browser console errors or JavaScript exceptions on user machines that may indicate injected payload failures. If available, enable GitLab's application performance monitoring to detect unauthorized session token exfiltration or cross-user data access patterns.

Why prioritize this

Although the CVSS score of 7.3 places this in the HIGH category and the attack requires administrative privilege and user interaction, the potential for session hijacking and data theft warrants prompt patching. Organizations with strict admin access governance and limited privilege delegation may deprioritize relative to critical vulnerabilities, but those with broader admin populations or history of account compromise should treat this as urgent. The three-month gap between affected versions suggests a relatively recent discovery; timely patching prevents opportunistic exploitation of unpatched instances.

Risk score, explained

CVSS 7.3 reflects: Network-accessible vector (AV:N), high complexity (AC:H) due to the need for proper input formatting and user interaction, high privilege requirement (PR:H) limiting the attacker pool, required user interaction (UI:R), scope change (S:C) enabling cross-user impact, and high confidentiality and integrity impact (C:H/I:H) against session and data integrity. The absence of availability impact (A:N) prevents a critical rating. Organizations with robust admin oversight and no delegated admin roles may assess their practical risk lower than the numerical score.

Frequently asked questions