Nixpkgs security tracker

Try the new UI
Login with GitHub

Suggestion detail

Untriaged
Permalink CVE-2026-19619
4.7 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): High (H)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Required (R)
  • Scope (S): Changed (C)
  • Confidentiality (C): Low (L)
  • Integrity (I): Low (L)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Changed (C)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): None (N)
created 4 days, 21 hours ago Activity log
  • Created suggestion 4 days, 21 hours ago
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an unauthenticated user to execute arbitrary JavaScript in the context of a targeted user's session due to improper sanitization of pasted HTML content in the Content Editor.

Affected products

GitLab
  • <19.1.8
  • <19.3.2
  • <19.2.6

Matching in nixpkgs

pkgs.gitlab

GitLab Community Edition

  • nixos-unstable -
  • nixos-26.05 -

pkgs.gitlab-ee

GitLab Enterprise Edition

  • nixos-unstable -
  • nixos-26.05 -

pkgs.gitlab-art

Pull cross-project Gitlab artifact dependencies

  • nixos-unstable -
    • nixos-unstable-small 0.5.0
  • nixos-26.05 -
    • nixos-26.05-small 0.5.0

pkgs.gitlab-duo

CLI for GitLab AI assistant

  • nixos-unstable -
    • nixos-unstable-small 9.6.0
  • nixos-26.05 -

pkgs.gitlab-kas

Kubernetes Agent (Gitlab side)

  • nixos-unstable -
  • nixos-26.05 -

pkgs.gitlab-ci-ls

GitLab CI Language Server (gitlab-ci-ls)

  • nixos-unstable -
    • nixos-unstable-small 1.4.0
  • nixos-26.05 -
    • nixos-26.05-small 1.3.2

pkgs.gitlab-pages

Daemon used to serve static websites for GitLab users

  • nixos-unstable -
  • nixos-26.05 -

pkgs.gitlab-shell

SSH access and repository management app for GitLab

  • nixos-unstable -
  • nixos-26.05 -

pkgs.danger-gitlab

Gem that exists to ensure all dependencies are set up for Danger with GitLab

  • nixos-unstable -
  • nixos-26.05 -

pkgs.gitlab-clippy

Convert clippy warnings into GitLab Code Quality report

  • nixos-unstable -
    • nixos-unstable-small 1.0.3
  • nixos-26.05 -
    • nixos-26.05-small 1.0.3

pkgs.gitlab-runner

GitLab Runner the continuous integration executor of GitLab

  • nixos-unstable -
  • nixos-26.05 -

pkgs.gitlab-triage

GitLab's issues and merge requests triage, automated

  • nixos-unstable -
  • nixos-26.05 -

pkgs.gitlab-ci-local

Run gitlab pipelines locally as shell executor or docker executor

  • nixos-unstable -
  • nixos-26.05 -

pkgs.gitlab-timelogs

CLI utility to support you with your time logs in GitLab

  • nixos-unstable -
    • nixos-unstable-small 0.7.1
  • nixos-26.05 -
    • nixos-26.05-small 0.7.1

pkgs.gitlab-ci-linter

.gitlab-ci.yml lint helper tool

  • nixos-unstable -
    • nixos-unstable-small 2.4.0
  • nixos-26.05 -
    • nixos-26.05-small 2.4.0

pkgs.gitlab-ci-validate

Command line tool to validate .gitlab-ci.yml files

  • nixos-unstable -
    • nixos-unstable-small 0.6.0

pkgs.gitlab-release-cli

Toolset to create, retrieve and update releases on GitLab

  • nixos-unstable -
  • nixos-26.05 -

pkgs.ocamlPackages.gitlab

Native OCaml bindings to Gitlab REST API v4

  • nixos-unstable -
    • nixos-unstable-small 0.1.8
  • nixos-26.05 -
    • nixos-26.05-small 0.1.8

Package maintainers