CVE-2026-19619

score

0.2

cvss

4.7

epss

0.2%

published

2026-09-16

kev added

—

first seen

2026-10-21

GitLab CE/EE 19.0 < 19.1.8, 19.2 < 19.2.6, and 19.3 < 19.3.2 contain a stored XSS caused by improper sanitization of pasted HTML content in the Content Editor, letting unauthenticated attackers execute arbitrary JavaScript in targeted user sessions, exploit requires user interaction with malicious content.