GitLab Analytics Dashboard Stored XSS via Input Sanitization

GitLab has remediated an issue in GitLab EE affecting all versions from 17.1 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to execute arbitrary client-side code on behalf of a targeted user due to improper input sanitization in the Analytics Dashboard.

Casky was already ahead

This CVE exploits attack patterns that Casky's 301matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-10087 is a stored cross-site scripting (XSS) vulnerability in GitLab Enterprise Edition's Analytics Dashboard that allows authenticated developers to inject and execute arbitrary client-side code targeting other users. The vulnerability stems from improper input sanitization, enabling attackers to craft malicious payloads that persist in the dashboard and execute in victims' browsers. This affects GitLab versions 17.1 through 18.10.7, 18.11 through 18.11.4, and 19.0 through 19.0.1, impacting organizations relying on these versions for analytics functionality. With a CVSS score of 8.7, this represents a significant risk because developer-level permissions are common in many organizations, and the ability to execute code on behalf of targeted users could lead to account compromise, credential theft, or lateral movement within the GitLab environment.

Casky's 301 mapped skills leverage Claude AI's extended reasoning to detect the attack patterns associated with TA0001 (Reconnaissance) and TA0043 (Persistence) techniques underlying this vulnerability. Practitioners would observe detection across input validation analysis skills that identify inadequate sanitization in user-controlled fields, output encoding verification skills that flag missing HTML entity encoding in dashboard rendering, and DOM-based XSS detection skills that trace malicious payload execution paths. When analyzing GitLab analytics configurations, Casky would surface findings highlighting stored payload persistence mechanisms, developer permission abuse patterns, and cross-user execution contexts. The combination of these skill findings provides practitioners with clear evidence of how an attacker moves from initial access (developer role) through reconnaissance of target users to persistent code execution, enabling rapid incident response and remediation prioritization.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

301 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-10087.

analyzing-apt-group-with-mitre-navigator

threat intelligence · low

Run

analyzing-campaign-attribution-evidence

threat intelligence · low

Run

analyzing-certificate-transparency-for-phishing

threat intelligence · low

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-10087

Casky has 301 skills that investigate the attack patterns behind CVE-2026-10087. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn