Deze pagina is nog niet vertaald naar uw taal. We werken eraan — de inhoud wordt voorlopig in het Engels weergegeven.
💡 Keep dependencies up to date — most exploits target known, patchable vulnerabilities.
CVE-2026-6335: XSS in GitLab 18.11
wordt vertaald…Platform
gitlab
Component
gitlab
Opgelost in
18.11.3
CVE-2026-6335 is a Cross-Site Scripting (XSS) vulnerability affecting GitLab Community Edition (CE) and Enterprise Edition (EE). This flaw allows an authenticated user, under specific conditions, to execute arbitrary code within the browser session of another user. The vulnerability impacts GitLab versions 18.11.0 through 18.11.3, and a fix is available in version 18.11.3.
Impact en Aanvalsscenarioswordt vertaald…
Successful exploitation of CVE-2026-6335 could allow an attacker to impersonate another user within GitLab, potentially gaining access to sensitive data or performing actions on their behalf. This could include viewing private repositories, modifying project settings, or even accessing administrative functions if the targeted user possesses elevated privileges. The impact is amplified if the targeted user has access to critical infrastructure or sensitive data, leading to a broader compromise of the GitLab instance. The ability to execute code within another user's browser session represents a significant security risk, as it bypasses traditional authentication mechanisms.
Uitbuitingscontextwordt vertaald…
CVE-2026-6335 was published on 2026-05-14. As of this date, there are no publicly known active campaigns exploiting this vulnerability. No public Proof-of-Concept (POC) code has been released. The vulnerability is not listed on KEV (Kernel Exploit Vulnerability) and has a low EPSS (Exploit Prediction Scoring System) score, indicating a relatively low probability of exploitation in the wild.
Dreigingsinformatie
Exploit Status
CVSS-vector
Wat betekenen deze metrics?
- Attack Vector
- Netwerk — op afstand uitbuitbaar via internet. Geen fysieke of lokale toegang vereist.
- Attack Complexity
- Laag — geen speciale voorwaarden vereist. Betrouwbaar uitbuitbaar.
- Privileges Required
- Laag — elk geldig gebruikersaccount is voldoende.
- User Interaction
- Vereist — slachtoffer moet een bestand openen, op een link klikken of een pagina bezoeken.
- Scope
- Gewijzigd — aanval kan voorbij het kwetsbare component uitbreiden naar andere systemen.
- Confidentiality
- Laag — gedeeltelijke toegang tot enkele gegevens.
- Integrity
- Laag — aanvaller kan enkele gegevens met beperkte omvang aanpassen.
- Availability
- Geen — geen beschikbaarheidsimpact.
Getroffen Software
Zwakheidsclassificatie (CWE)
Tijdlijn
- Gereserveerd
- Gepubliceerd
Mitigatie en Workaroundswordt vertaald…
The primary mitigation for CVE-2026-6335 is to immediately upgrade GitLab to version 18.11.3 or later. If upgrading is not immediately feasible, consider implementing stricter input validation on user-supplied data within GitLab. While not a direct fix, this can help reduce the attack surface. Review GitLab's security configuration and ensure that all security features are enabled and properly configured. Monitor GitLab logs for any suspicious activity that might indicate exploitation attempts.
Hoe te verhelpenwordt vertaald…
Actualice GitLab a la versión 18.11.3 o posterior para mitigar la vulnerabilidad de Cross-Site Scripting (XSS). Esta actualización corrige la sanitización inadecuada de la entrada, previniendo la ejecución de código arbitrario en el navegador de otros usuarios.
Veelgestelde vragenwordt vertaald…
What is CVE-2026-6335 — XSS in GitLab 18.11?
CVE-2026-6335 is a Cross-Site Scripting (XSS) vulnerability in GitLab CE/EE versions 18.11.0 through 18.11.3. It allows an authenticated user to potentially execute code in another user's browser session.
Am I affected by CVE-2026-6335 in GitLab 18.11?
If you are running GitLab CE or EE versions 18.11.0, 18.11.1, 18.11.2, or 18.11.3, you are potentially affected by this vulnerability. Upgrade to 18.11.3 or later.
How do I fix CVE-2026-6335 in GitLab 18.11?
The recommended fix is to upgrade GitLab to version 18.11.3 or a later version. This patch addresses the improper sanitization issue.
Is CVE-2026-6335 being actively exploited?
As of 2026-05-14, there are no publicly known active campaigns exploiting this vulnerability, and no public POC code is available.
Where can I find the official GitLab advisory for CVE-2026-6335?
Refer to the official GitLab security advisory for CVE-2026-6335 on the GitLab website: [https://gitlab.com/security/advisories/](https://gitlab.com/security/advisories/)
Is jouw project getroffen?
Upload je dependency-bestand en kom direct te weten of deze en andere CVEs jou raken.
Probeer het nu — geen account
Upload een manifest (composer.lock, package-lock.json, WordPress pluginlijst…) of plak uw componentenlijst. U ontvangt direct een kwetsbaarheidsrapport. Een bestand uploaden is slechts het begin: met een account krijgt u continue monitoring, Slack/e-mail alerts, multi-project en white-label rapporten.
Sleep uw afhankelijkheidsbestand hierheen
composer.lock, package-lock.json, requirements.txt, Gemfile.lock, pubspec.lock, Dockerfile...