GitLab Enterprise Edition contains a flaw in its customizable analytics dashboards that allows an authenticated user to submit input that is not properly sanitized before being rendered into a web page. The unsanitized data is inserted as JavaScript, enabling the attacker to execute arbitrary scripts in the browsers of other authenticated users who view the affected dashboard. Such scripts could steal session cookies, perform actions on behalf of the victim, or conduct other client‑side attacks.

The vulnerability affects GitLab EE installations running versions starting at 18.2 and up through 18.10.2, excluding any releases that have been upgraded to 18.8.9, 18.9.5, 18.10.3 or later. Users of any of those previous releases that have not applied the stated patches are exposed.

The CVSS score of 5.4 indicates medium severity. Exploitation requires the attacker to be an authenticated user with permission to edit or create dashboards. Because the impact is limited to the victim’s browser, it does not allow server compromise, but it can lead to credential theft or session hijacking. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting that widespread exploitation has not yet been observed. Nevertheless, the ability to compromise client‑side sessions warrants timely remediation.