CVE-2026-6335

MediumCVSS 5.4/10Last modified Nov 11, 2026

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.11 before 18.11.3 that under certain conditions could have allowed an authenticated user to execute arbitrary code in another user's browser session due to improper sanitization.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
GitLabGitLab>= 18.11, < 18.11.3

References

Timeline

Published
May 14, 2026
Last modified
Nov 11, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-633509.6Affected devices do not properly restrict executable content contained in imported trace files. This could allow an attacker to social enCVE-2026-633516.1Affected devices do not properly validate and sanitize visual properties of calculated signals contained in imported CSV trace files before CVE-2026-633526.1Affected devices do not properly sanitize calculated signal data contained in imported CSV trace files before rendering it on the Trace pageCVE-2026-633539.6Affected devices do not properly sanitize comment fields contained in imported trace files before rendering them on the Trace page. This CVE-2026-633549.6Affected devices do not properly validate and sanitize visual marker data contained in imported CSV trace files before rendering it on the TCVE-2026-633556.1Affected devices do not properly sanitize signal names contained in imported CSV trace files before rendering them in selection menus on theCVE-2026-633566.1Affected devices do not properly sanitize calculated signal names contained in imported CSV trace files before including them in error messaCVE-2026-633576.1Affected devices do not properly sanitize calculated signal data contained in imported calculated signal files before rendering it on the TrCVE-2026-633587.3FileGator accepts arbitrary Unix permission values via the '/chmoditems' API endpoint and passes the value directly to PHP's native 'chmod()CVE-2026-633599.8The Appriss Insights (Equifax) Victim Information Notification Exchange (VINE) applications allow an unauthenticated attacker to send a specCVE-2026-63365.3GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.6 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 thCVE-2026-633607.4LimeSurvey Community Edition 7.0.5+260623 contains an authenticated reflected Cross-Site Scripting vulnerability in the user activation conf
CVE-2026-6335: Medium severity, CVSS 5.4 | Vulnix