CVE-2026-3093 is a cross-site scripting (XSS) vulnerability in GitLab Community and Enterprise Editions affecting all versions from 14.0 up to but not including 19.0.5, versions 19.1 up to but not including 19.1.3, and versions 19.2 up to but not including 19.2.1. The issue arises from improper sanitization of user-controlled input, which under certain conditions could allow an attacker to execute arbitrary JavaScript in the context of another user's browser via a crafted URL. This vulnerability has been officially remediated by GitLab in the fixed versions 19.0.5, 19.1.3, and 19.2.1.

Successful exploitation could allow an attacker to execute arbitrary JavaScript in the victim's browser, potentially leading to information disclosure or session hijacking. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity, with no impact on availability. There are no known exploits in the wild at this time.

A fix is available and has been released by GitLab. Users should upgrade affected GitLab CE/EE instances to versions 19.0.5, 19.1.3, or 19.2.1 or later to remediate this vulnerability. No additional mitigation steps are indicated by the vendor advisory.