CVE-2026-15216

This is a stored XSS vulnerability in GitLab's analytics dashboard where malicious payload executes through pagination controls. The critical insight is that pagination components occupy a security-relevant position that most teams overlook — they render within authenticated analytics contexts that aggregate access across projects, users, and integrations. An XSS payload executing there inherits a privileged session with cross-project visibility, making this far more severe than a comment-field XSS that affects only the commenter. The vulnerability likely originated from a refactor that attached a new data source to an existing pagination component whose prior inputs happened to be trusted, rather than from someone writing unsafe code directly. Check your own analytics dashboards for pagination components that render data from multiple sources, particularly those aggregating user identifiers, project names, or query parameters. Audit the data pipeline feeding those components — the fix isn't just patching the rendering call but ensuring sanitization occurs at every trust boundary the data crosses. The component library you use likely carries forward implicit trust assumptions from when analytics dashboards were simpler internal tools; treat pagination controls on modern analytics surfaces as session-context boundaries requiring the same scrutiny as authentication surfaces. If your organization has shared pagination components, ensure the security boundary is embedded in the component itself rather than assumed at each usage site — patching individual instances won't close the class if the underlying component trusts its inputs by default.

Reviewed through automated stages and approved by a human before publication.