# CVE-2026-84739

Authenticated XSS in GitLab merge-request diff viewer affecting many versions.

- Page: https://www.vulneraibility.com/cve/CVE-2026-84739
- CVSS: 8.7
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 0.34% (percentile 28.2)
- CISA SSVC: exploitation none, automatable no, technical impact total (assessed 2026-09-29)
- Weakness: CWE-79
- Published: 2026-09-29

## Affected versions

- GitLab: affected >= 13.11 and < 19.2.7; >= 19.3 and < 19.3.3; >= 19.4 and < 19.4.1

A version outside these ranges is not a statement that it is unaffected.

## Impact

Authenticated attacker can execute arbitrary JS in other users' browsers, steal sessions, perform actions as victims, and escalate to further compromise.

## Action

Patch when possible

## Recommendation

Upgrade GitLab to fixed versions (>=19.2.7, 19.3.3, 19.4.1) immediately.

## References

- [other] https://gitlab.com/gitlab-org/gitlab/-/work_items/627316
- [exploit] https://hackerone.com/reports/3938482
- [other] https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-1-released/

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.