Is CVE-2026-13320 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-13320 being exploited in the wild.

How severe is CVE-2026-13320?

High severity, with a CVSS score of 7.3, published 8 July 2026.

Which products and versions are affected?

GitLab Community Edition 15.7 to 18.11.7, 19.0 to 19.0.4, 19.1 to 19.1.2; GitLab Enterprise Edition 15.7 to 18.11.7, 19.0 to 19.0.4, 19.1 to 19.1.2.

Is there a fix for CVE-2026-13320?

A patch was published on 2026-07-08. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-13320 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-13320?

Check whether you run GitLab Community Edition or GitLab Enterprise Edition at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-13320: GitLab CE/EE HTML injection in wiki markup rendering

CVE-2026-13320 · Severity: high · CVSS 7.3 · Published 2026-07-08

GitLab, a platform used by software teams to manage and host code, has addressed a security flaw in its wiki feature. An attacker with high-level permissions could inject malicious code into a wiki page that executes in the browser of other users who view it. This could lead to unauthorized actions being performed on behalf of the victim or the theft of sensitive session information.

Technologies: GitLab Community Edition, GitLab Enterprise Edition. Vendors: GitLab.

Quick answers

Is CVE-2026-13320 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-13320 being exploited in the wild.
How severe is CVE-2026-13320?: High severity, with a CVSS score of 7.3, published 8 July 2026.
Which products and versions are affected?: GitLab Community Edition 15.7 to 18.11.7, 19.0 to 19.0.4, 19.1 to 19.1.2; GitLab Enterprise Edition 15.7 to 18.11.7, 19.0 to 19.0.4, 19.1 to 19.1.2.
Is there a fix for CVE-2026-13320?: A patch was published on 2026-07-08. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-13320 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-13320?: Check whether you run GitLab Community Edition or GitLab Enterprise Edition at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stored Cross-Site Scripting (XSS) vulnerability exists in GitLab CE/EE within the wiki markup rendering component. The flaw stems from improper sanitization of user-supplied input, allowing for HTML injection. An attacker requires high privileges (PR:H) and the attack requires a victim to interact with the malicious wiki page (UI:R). Under these conditions, the attacker can execute arbitrary JavaScript in the context of the victim's browser session. GitLab has released patches in versions 18.11.7, 19.0.4, and 19.1.2 to address this issue.

Affected products

GitLab GitLab Community Edition 15.7 to 18.11.7, 19.0 to 19.0.4, 19.1 to 19.1.2
GitLab GitLab Enterprise Edition 15.7 to 18.11.7, 19.0 to 19.0.4, 19.1 to 19.1.2

Timeline

2026-07-08: advisory: GitLab released security patches for this vulnerability.
2026-07-08: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.