Search: CVE-2026-10712

A cross-site scripting (XSS) vulnerability was identified in GitLab CE/EE affecting versions from 18.10 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1. This flaw allowed an unauthenticated user to execute arbitrary JavaScript in another user's browser session due to improper path validation under certain conditions. GitLab has released patches to remediate this issue.