Executive brief
GitLab, a platform used by software teams to manage and host code, has addressed a security flaw in its wiki feature. An attacker with high-level permissions could inject malicious code into a wiki page that executes in the browser of other users who view it. This could lead to unauthorized actions being performed on behalf of the victim or the theft of sensitive session information.
Technical details
A stored Cross-Site Scripting (XSS) vulnerability exists in GitLab CE/EE within the wiki markup rendering component. The flaw stems from improper sanitization of user-supplied input, allowing for HTML injection. An attacker requires high privileges (PR:H) and the attack requires a victim to interact with the malicious wiki page (UI:R). Under these conditions, the attacker can execute arbitrary JavaScript in the context of the victim's browser session. GitLab has released patches in versions 18.11.7, 19.0.4, and 19.1.2 to address this issue.
Affected products
- GitLab GitLab Community Edition 15.7 to 18.11.7, 19.0 to 19.0.4, 19.1 to 19.1.2
- GitLab GitLab Enterprise Edition 15.7 to 18.11.7, 19.0 to 19.0.4, 19.1 to 19.1.2
Timeline
- 2026-07-08: advisory: GitLab released security patches for this vulnerability.
- 2026-07-08: patched