GitLab exposed all Enterprise Edition releases prior to 18.10.8, 18.11.5, and 19.0.2 to an improper input sanitization flaw in the Analytics Dashboard. An authenticated user with developer‑level permissions could inject malicious script that would run in the browser of any user viewed the affected dashboard. This vulnerability is a classic Cross‑Site Scripting (CWE‑79) flaw that could allow an attacker to hijack user sessions, steal credentials, or execute additional client‑side attacks within the context of the targeted user’s account.

The affected products are GitLab Enterprise Edition running any version from 17.1 up to, but not including, 18.10.8, 18.11.5, and 19.0.2. All other software components of GitLab are not directly impacted by the flaw.

The CVSS score of 8.7 classifies this issue as high severity, and the lack of an EPSS score indicates no public data on exploitation frequency, but the KEV catalog does not list it as a known exploited vulnerability. The most likely attack vector is that a malicious developer could craft a dashboard entry that includes script tags; when a target user opens the dashboard, the code executes in the target’s browser. The exploitation requires the attacker to have developer permissions and the target to view the corrupted dashboard, so the risk is significant in environments that grant widespread developer access.