CVE-2020-26407

5.4 mediumEPSS 0.8%

Medium (5.4) in gitlab gitlab. EPSS 0.8% chance of exploitation in the next 30 days.

A XSS vulnerability exists in Gitlab CE/EE from 12.4 before 13.4.7, 13.5 before 13.5.5, and 13.6 before 13.6.2 that allows an attacker to perform cross-site scripting to other users via importing a malicious project

Severity

CVSS 3.1

5.4 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.8% chance of exploitation in the next 30 days; higher than 58% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2020-12-10
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

gitlab:gitlab

References

https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-26407.json
https://gitlab.com/gitlab-org/gitlab/-/issues/212630
https://hackerone.com/reports/832117
https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-26407.json
https://gitlab.com/gitlab-org/gitlab/-/issues/212630

Check your stack JSON