CVE-2026-19619

MediumCVSS 4.7/10Last modified Sep 28, 2026

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an unauthenticated user to execute arbitrary JavaScript in the context of a targeted user's session due to improper sanitization of pasted HTML content in the Content Editor.

Metrics

CVSS 3.1 4.7/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
GitLab	GitLab	>= 19.0, < 19.1.8; >= 19.2, < 19.2.6; >= 19.3, < 19.3.2

References

https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-3-2-released/Release Notes, Vendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/work_items/612792Broken Link
https://hackerone.com/reports/3808840Permissions Required

Timeline

Published: Sep 16, 2026
Last modified: Sep 28, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-19629.8A vulnerability has been found in WeKan up to 8.20. The impacted element is an unknown function of the file server/attachmentMigration.js of CVE-2026-196208.8IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to gain unauthorized administrative access due to improper authentication.CVE-2026-196216.5Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to strip action integration secrets from p CVE-2026-196229.8IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to bypass authentication and escalate privileges due to improper validatio CVE-2026-196247.8A flaw was found in NetworkManager-l2tp. The plugin writes attacker-controlled VPN connection properties (vpn.data and vpn.secrets values) u CVE-2026-196255.3When a Quarkus application has multiple endpoints secured by individual OIDC provider tenants, such as "/oidc-provider1" that is secured by CVE-2026-196269.9A remote code execution vulnerability exists in Tenable Security Center's report generation functionality. An authenticated, non-administrat CVE-2026-196278.2IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to read arbitrary host files and overwrite certain application files due t CVE-2026-196287.2A command injection vulnerability exists in Tenable Security Center. An authenticated administrator could modify application configuration v CVE-2026-196298.1A privilege escalation vulnerability exists in Tenable Security Center that allows a user with "Security Manager" role and "manage user" per CVE-2026-19639.8A vulnerability was found in WeKan up to 8.20. This affects an unknown function of the file models/attachments.js of the component Attachmen CVE-2026-196307.5In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit imposed by