此页面尚未翻译为您的语言。我们正在努力翻译，目前显示英文内容。
💡 Keep dependencies up to date — most exploits target known, patchable vulnerabilities.
CVE-2026-6073 describes a Cross-Site Scripting (XSS) vulnerability discovered in GitLab EE. This flaw allows an authenticated user to inject and execute arbitrary JavaScript code within the browsers of other GitLab users. The vulnerability impacts versions 18.7.0 through 18.11.3, and a patch is available in version 18.11.3.
影响与攻击场景翻译中…
Successful exploitation of CVE-2026-6073 could lead to a wide range of malicious activities. An attacker could steal session cookies, allowing them to impersonate other users and gain unauthorized access to sensitive data. They could also inject malicious scripts to deface GitLab pages, redirect users to phishing sites, or even execute arbitrary commands on the server if the browser has sufficient privileges. The impact is particularly severe given GitLab's widespread use in software development and DevOps workflows, where sensitive code and project data are often stored.
利用背景翻译中…
CVE-2026-6073 was published on May 14, 2026. As of this date, there is no public evidence of active exploitation in the wild. The vulnerability is not currently listed on KEV or EPSS, suggesting a low to medium probability of exploitation. Public proof-of-concept (POC) code may emerge, increasing the risk. Refer to the official GitLab advisory for further details.
威胁情报
漏洞利用状态
CISA SSVC
CVSS 向量
这些指标意味着什么？
- Attack Vector
- 网络 — 可通过互联网远程利用，无需物理或本地访问。攻击面最大。
- Attack Complexity
- 低 — 无需特殊条件，可以稳定地利用漏洞。
- Privileges Required
- 低 — 任何有效用户账户均可。
- User Interaction
- 需要 — 受害者必须打开文件、点击链接或访问特制页面。
- Scope
- 已改变 — 攻击可以超出脆弱组件，影响其他系统。
- Confidentiality
- 高 — 完全丧失机密性，攻击者可读取所有数据。
- Integrity
- 高 — 攻击者可写入、修改或删除任何数据。
- Availability
- 无 — 无可用性影响。
受影响的软件
弱点分类 (CWE)
时间线
- 已保留
- 发布日期
缓解措施和替代方案翻译中…
The primary mitigation for CVE-2026-6073 is to upgrade GitLab EE to version 18.11.3 or later. If an immediate upgrade is not possible, consider implementing stricter input validation and output encoding measures to sanitize user-supplied data. Web Application Firewalls (WAFs) configured with rules to detect and block XSS payloads can provide an additional layer of defense. Regularly review and update GitLab's security configuration to ensure best practices are followed. After upgrading, confirm the fix by attempting to inject a simple JavaScript payload through a user input field and verifying that it is properly sanitized.
修复方法翻译中…
Actualice GitLab a la versión 18.9.7 o superior, 18.10.6 o superior, o 18.11.3 o superior para mitigar la vulnerabilidad de Cross-Site Scripting (XSS). Esta actualización corrige la falta de sanitización adecuada de la entrada del usuario, previniendo la ejecución de código JavaScript malicioso en el navegador de otros usuarios. Consulte las notas de la versión para obtener instrucciones detalladas de actualización.
常见问题翻译中…
What is CVE-2026-6073 — XSS in GitLab?
CVE-2026-6073 is a Cross-Site Scripting (XSS) vulnerability in GitLab EE that allows authenticated users to execute JavaScript in other users' browsers. It affects versions 18.7.0–18.11.3.
Am I affected by CVE-2026-6073 in GitLab?
You are affected if you are running GitLab EE versions 18.7.0 through 18.11.3. Check your GitLab version immediately and upgrade if necessary.
How do I fix CVE-2026-6073 in GitLab?
Upgrade GitLab EE to version 18.11.3 or later. If immediate upgrade isn't possible, implement stricter input validation and output encoding.
Is CVE-2026-6073 being actively exploited?
As of May 14, 2026, there is no public evidence of active exploitation in the wild, but the risk remains until patched.
Where can I find the official GitLab advisory for CVE-2026-6073?
Refer to the official GitLab security advisory for CVE-2026-6073: [https://gitlab.com/security/advisories/CVE-2026-6073](https://gitlab.com/security/advisories/CVE-2026-6073)
立即试用 — 无需账户
上传任何清单文件 (composer.lock, package-lock.json, WordPress 插件列表…) 或粘贴您的组件列表。您立即获得一份漏洞报告。上传文件只是开始：拥有账户后，您将获得持续监控、Slack/电子邮件警报、多项目和白标报告。
拖放您的依赖文件
composer.lock、package-lock.json、requirements.txt、Gemfile.lock、pubspec.lock、Dockerfile...