Medium severity5.4NVD Advisory· Published Apr 8, 2026· Updated Apr 16, 2026
CVE-2026-4332
CVE-2026-4332
Description
GitLab has remediated an issue in GitLab EE affecting all versions from 18.2 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that, in customizable analytics dashboards, could have allowed an authenticated user to execute arbitrary JavaScript in the context of other users' browsers due to improper input sanitization.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*+ 1 more
- cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*range: >=18.2.0,<18.8.9
- (no CPE)range: >=18.2, <18.8.9; >=18.9, <18.9.5; >=18.10, <18.10.3
Patches
Vulnerability mechanics
References
2- about.gitlab.com/releases/2026/04/08/patch-release-gitlab-18-10-3-released/nvdRelease NotesVendor Advisory
- hackerone.com/reports/3600345nvdPermissions Required
News mentions
1- GitLab Patch Release: 18.10.3, 18.9.5, 18.8.9GitLab Security Releases · Apr 8, 2026