Skip to content
CVE PROGRAM SOURCE RECORD7.7 High

CVE-2026-16627

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to escalate privileges due to improper sanitization of HTML content rendered in a CI job modal.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

GitLab GitLab

Default version status: unaffected

  • 19.2 to < 19.2.2affected

References