CVE-2026-5816

CVE-2026-5816 is a cross-site scripting vulnerability affecting GitLab Community Edition and Enterprise Edition versions 18.10 before 18.10.4 and 18.11 before 18.11.1. The flaw stems from improper path validation that allows unauthenticated attackers to inject and execute arbitrary JavaScript code within a victim's browser session under specific conditions. This vulnerability requires user interaction to trigger but can result in complete compromise of session confidentiality and integrity. The vulnerability carries a HIGH severity rating with a CVSS v3.1 score of 8.0, reflecting its network-accessible attack vector and requirement for user interaction. The attack has high complexity and does not require authentication, but successful exploitation depends on tricking users into performing specific actions. The potential impact includes high confidentiality and integrity violations, though availability is not affected. There is no evidence of active exploitation in the wild, as the vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog and remains inactive on threat tracking lists. The EPSS score of 0.00012 indicates extremely low probability of exploitation in real-world scenarios compared to other published CVEs. Organizations should prioritize patching to the fixed versions (18.10.4 or 18.11.1 and later) as part of routine security maintenance but need not treat this as an emergency incident response priority.