🚨 CVE-2026-7377: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab Stored XSS in Custom Analytics Dashboards An authenticated attacker could inject malicious JavaScript into customizable analytics dashboards via unsanitized user input, leading to arbitrary code execution in the browsers of other users viewing those dashboards. Full Vulnerability Details & Analysis at DarkEye: 🔗 https://darkeye.org/vuln/cve/CVE-2026-7377 🔍 Identify Targets via ZoomEye: Filter: vul.cve="CVE-2026-7377" Search Dork: app="Gitlab" Exposure: 1.2m+ instances identified globally. ZoomEye Search Link: 👉 https://www.zoomeye.ai/searchResult?q=YXBwPSJHaXRsYWIi&utm_source=twitter&utm_medium=social&utm_campaign=cve_ops_20260514 #XSS #GitLab #StoredXSS #DashboardVuln #CVE20267377 #DarkEye
Post summary
The tweet reports a new stored XSS vulnerability (CVE‑2026‑7377) in GitLab's custom analytics dashboards, provides technical details, global exposure figures via ZoomEye, and links to a full analysis, but offers no PoC, exploit code, patch, or evidence of active exploitation.
