# CVE-2026-13320: GitLab CE/EE HTML injection in wiki markup rendering

Source: https://junglewise.ai/threats/cve-2026-13320-gitlab-ce-ee-html-injection-in-wiki-markup-rendering  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-08. Updated: 2026-07-08  
License: CC BY 4.0 with a link back

CVE-2026-13320 · Severity: high · CVSS 7.3 · Published 2026-07-08

GitLab, a platform used by software teams to manage and host code, has addressed a security flaw in its wiki feature. An attacker with high-level permissions could inject malicious code into a wiki page that executes in the browser of other users who view it. This could lead to unauthorized actions being performed on behalf of the victim or the theft of sensitive session information.

Technologies: [GitLab Community Edition](https://junglewise.ai/threats/technologies/gitlab-ce), [GitLab Enterprise Edition](https://junglewise.ai/threats/technologies/gitlab-ee). Vendors: [GitLab](https://junglewise.ai/threats/vendors/gitlab).

## Quick answers

**Is CVE-2026-13320 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-13320 being exploited in the wild.

**How severe is CVE-2026-13320?** High severity, with a CVSS score of 7.3, published 8 July 2026.

**Which products and versions are affected?** GitLab Community Edition 15.7 to 18.11.7, 19.0 to 19.0.4, 19.1 to 19.1.2; GitLab Enterprise Edition 15.7 to 18.11.7, 19.0 to 19.0.4, 19.1 to 19.1.2.

**Is there a fix for CVE-2026-13320?** A patch was published on 2026-07-08. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-13320 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-13320?** Check whether you run GitLab Community Edition or GitLab Enterprise Edition at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stored Cross-Site Scripting (XSS) vulnerability exists in GitLab CE/EE within the wiki markup rendering component. The flaw stems from improper sanitization of user-supplied input, allowing for HTML injection. An attacker requires high privileges (PR:H) and the attack requires a victim to interact with the malicious wiki page (UI:R). Under these conditions, the attacker can execute arbitrary JavaScript in the context of the victim's browser session. GitLab has released patches in versions 18.11.7, 19.0.4, and 19.1.2 to address this issue.

## Affected products

- GitLab GitLab Community Edition 15.7 to 18.11.7, 19.0 to 19.0.4, 19.1 to 19.1.2
- GitLab GitLab Enterprise Edition 15.7 to 18.11.7, 19.0 to 19.0.4, 19.1 to 19.1.2

## Timeline

- 2026-07-08: advisory: GitLab released security patches for this vulnerability.
- 2026-07-08: patched

## References

- [https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-1-2-released/](https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-1-2-released/)
- [https://gitlab.com/gitlab-org/gitlab/-/work_items/604063](https://gitlab.com/gitlab-org/gitlab/-/work_items/604063)
- [https://hackerone.com/reports/3816917](https://hackerone.com/reports/3816917)

## Related threats

- [GitLab authentication bypass in OmniAuth SAML/LDAP auto-linking](https://junglewise.ai/threats/cve-2026-15723-gitlab-has-remediated-an-issue-in-gitlab-ce-ee-affecting-all)
- [GitLab Enterprise Edition authorization bypass in billing validation](https://junglewise.ai/threats/cve-2026-112378-gitlab-has-remediated-an-issue-in-gitlab-ee-affecting-all)
- [GitLab CE/EE internal credential exposure in response headers](https://junglewise.ai/threats/cve-2026-105777-gitlab-has-remediated-an-issue-in-gitlab-ce-ee-affecting-all)
- [GitLab CE/EE integer overflow in CI/CD regular expression compiler](https://junglewise.ai/threats/cve-2026-97229-gitlab-has-remediated-an-issue-in-gitlab-ce-ee-affecting-all)
- [GitLab Community Edition and Enterprise Edition cross-site scripting in syntax highlighting](https://junglewise.ai/threats/cve-2026-92883-gitlab-has-remediated-an-issue-in-gitlab-ce-ee-affecting-all)