Vulnerability Report

CVE-2026-4332

Title: Cross-Site Scripting in Analytics Dashboards

XSS

Proof Of Concept

No public PoC currently indexed for CVE-2026-4332.

CWE Category CWE-79

Published Date Apr 08, 2026

Modified Date Apr 16, 2026

Exploit Status Not Found

Score 5.4 CVSS v3.1

Exploit Probability (EPSS)

0.03%

Vulnerability Summary

CVE-2026-4332: GitLab has remediated an issue in GitLab EE affecting all versions from 18.2 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that, in customizable analytics dashboards, could have allowed an authenticated user to execute arbitrary JavaScript in the context of other users' browsers due to improper input sanitization.

Impacted Vendors

gitlab 1

jenkins 1

Reference Links

https://about.gitlab.com/releases/2026/04/08/patch-release-gitlab-18-10-3-released/ https://gitlab.com/gitlab-org/gitlab/-/work_items/593853 https://hackerone.com/reports/3600345

CVSS v3.1

Source Entity [email protected]

Severity MEDIUM

5.4

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

REQUIRED

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

CHANGED

RAW VECTOR CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Associated Attack Patterns (CAPEC)

Total: Patterns