CVE-2026-84739

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-84739

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-84739.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-84739

Published

2026-09-29T09:34:28Z

Modified

2026-10-01T03:47:35Z

Severity

8.7 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N CVSS Calculator

Summary

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

Details

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.11 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary JavaScript in the context of another user's browser session due to improper sanitization of path components in the merge request diff viewer.

Database specific

{
    "cna_assigner":  "GitLab",
    "cwe_ids":  [
        "CWE-79"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/84xxx/CVE-2026-84739.json"
}

References

Affected packages

Git / gitlab.com/gitlab-org/gitlab

Affected ranges

Type

GIT

Repo

https://gitlab.com/gitlab-org/gitlab

Events

Introduced

47f41a4a74f364c731aafd34a93bddb630f62230

Fixed

9fcb5013c2e849eaec247e3aec56f23b51b6d7dd

Introduced

8f83039bebbbb61d3b7b8b7e2342d1deec1e14c6

Fixed

5760a902b6c8d001a0e0212aedee40bd69d28a2d

Introduced

fa703f93afaf1133cd263f6aa0e91d284d7f1ebf

Fixed

26212baacadb5beea6664f7ef025d753dccfb0d6

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "13.11"
        },
        {
            "fixed":  "19.2.7"
        },
        {
            "introduced":  "19.3"
        },
        {
            "fixed":  "19.3.3"
        },
        {
            "introduced":  "19.4"
        },
        {
            "fixed":  "19.4.1"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

v19.*

v19.3.0-ee

v19.4.0-ee

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-84739.json"