CVE-2020-26407

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-12-10 · updated 2026-06-17
Weakness: CWE-79

Description

A XSS vulnerability exists in Gitlab CE/EE from 12.4 before 13.4.7, 13.5 before 13.5.5, and 13.6 before 13.6.2 that allows an attacker to perform cross-site scripting to other users via importing a malicious project

Affected products

GitLab: from 12.4.0 before 13.4.7; from 13.5.0 before 13.5.5; from 13.6.0 before 13.6.2 — fixed in 13.4.7, 13.5.5, 13.6.2

How to fix

Upgrade to a fixed version: GitLab 13.4.7, 13.5.5, 13.6.2. Check the vendor advisory for mitigations.

References

https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-26407.json
https://gitlab.com/gitlab-org/gitlab/-/issues/212630
https://hackerone.com/reports/832117
https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-26407.json
https://gitlab.com/gitlab-org/gitlab/-/issues/212630
https://hackerone.com/reports/832117

Get alerted when CVE-2020-26407 or the next vulnerability affects your stack