CVE-2026-0752

Published: Feb 25, 2026Modified: Jun 17, 2026

6.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.2 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 that under certain circumstances, could have allowed an unauthenticated user to inject arbitrary scripts into the Mermaid sandbox UI.

Affected (6)

Products: Gitlab: Gitlab

Gitlab

1 product

Gitlab

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Gitlab Gitlab	From 16.2.0 to 18.7.5
Gitlab Gitlab	From 18.8.0 to 18.8.5
Gitlab Gitlab	From 16.2.0 to 18.7.5
Gitlab Gitlab	From 18.8.0 to 18.8.5
Gitlab Gitlab	Version 18.9.0
Gitlab Gitlab	Version 18.9.0

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (3)

https://about.gitlab.com/releases/2026/02/25/patch-release-gitlab-18-9-1-released/

Source: cve@gitlab.com

Release NotesVendor Advisory

https://gitlab.com/gitlab-org/gitlab/-/issues/585371

Source: cve@gitlab.com

Broken Link

https://hackerone.com/reports/3473276

Source: cve@gitlab.com

Permissions Required

Timeline

No history available yet.