## Summary
GitLab CE/EE remediated a high-severity cross-site scripting (XSS) issue in the analytics dashboard component. Under certain conditions, user-controlled values rendered in table cell content could be improperly neutralized, enabling cross-site scripting.
## Technical Details
- Root issue class: CWE-79 (Improper Neutralization of User-Controlled Values in Web Pages)
- Affected rendering context: analytics dashboard component that renders table cell content (and, per the patch release notes, also pagination controls)
- Vulnerability behavior: user-controlled values could be rendered without proper neutralization, allowing script execution in the browser under specific conditions
- CVSS indicates network reachability with low attack complexity and user interaction (UI:R), and scope change (S:C)
## Affected
- GitLab CE/EE versions prior to the following fixed releases:
- 18.2 before 19.0.6
- 19.1 before 19.1.4
- 19.2 before 19.2.2
- GitLab patch release guidance (self-managed): upgrade to one of 19.2.2, 19.1.4, or 19.0.6 immediately
## Impact
- Cross-site scripting in the analytics dashboard UI
- Potential for confidentiality and integrity impact in the browser context (per CVSS: C:H, I:H), with no availability impact indicated (A:N)
## Mitigation
1. Upgrade self-managed GitLab CE/EE to one of the patched versions: 19.2.2, 19.1.4, or 19.0.6.
2. Prioritize instances running affected branches (18.2, 19.1, 19.2) that are behind on patch releases.
3. After upgrade, validate analytics dashboard views that include table cell content and pagination controls for expected safe rendering.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
CWE-79