CVE-2026-78252: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.3 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an authenticated user could have induced a targeted user to perform unintended state-changing HTTP requests due to improper sanitization of user-controlled data in the Markdown JSON table renderer.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 19.1.8 - Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 19.2.6 - Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 19.3.2
Event History
Frequently Asked Questions
Which GitLab versions need remediation?
GitLab CE/EE versions from 15.3 through versions before 19.1.8 are affected, as are 19.2 versions before 19.2.6 and 19.3 versions before 19.3.2. Upgrade to 19.1.8, 19.2.6, 19.3.2, or a later release in the applicable release line.
What does an attacker need to exploit this issue?
The attacker must be an authenticated GitLab user and must induce a targeted user to interact with malicious user-controlled data rendered through the Markdown JSON table renderer. The targeted user must perform an action, as indicated by the required user interaction vector.
What is the likely impact if exploitation succeeds?
A successful attack can cause the targeted user to make unintended state-changing HTTP requests. The published vector indicates high confidentiality and integrity impact, limited availability impact, and a scope change.