CVE-2026-0752: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.2 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 that under certain circumstances, could have allowed an unauthenticated user to inject arbitrary scripts into the Mermaid sandbox UI.
Other sources
GitLab has remediated an issue that under certain circumstances, could have allowed an unauthenticated user to inject arbitrary scripts into the Mermaid sandbox UI.
— GitLab
Affected Software
Remediation
Information
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2026-0752?
CVE-2026-0752 is classified as a medium severity vulnerability due to its potential for cross-site scripting attacks.
How do I fix CVE-2026-0752?
To fix CVE-2026-0752, upgrade GitLab to the latest version beyond the affected versions: 18.7.5, 18.8.5, or 18.9.1.
Which versions of GitLab are affected by CVE-2026-0752?
CVE-2026-0752 affects GitLab versions from 16.2 up to 18.7.5, 18.8 up to 18.8.5, and 18.9 up to 18.9.1.
What type of vulnerability is CVE-2026-0752?
CVE-2026-0752 is a Cross-site Scripting (XSS) vulnerability affecting the Mermaid sandbox in GitLab.
Can unauthenticated users exploit CVE-2026-0752?
Yes, an unauthenticated user could potentially exploit CVE-2026-0752 to inject arbitrary scripts into the Mermaid sandbox UI.