Executive brief
GitLab Community and Enterprise Edition contains a cross-site scripting (XSS) vulnerability in its Markdown JSON table renderer. An authenticated attacker could trick users into clicking malicious links or performing unintended actions by embedding malicious code in table data. This could lead to unauthorized access to user accounts, data theft, or manipulation of GitLab projects and repositories.
Technical details
The vulnerability is a Cross-site Scripting (XSS) issue in GitLab's Markdown JSON table renderer caused by improper sanitization of user-controlled data. An authenticated user can craft malicious Markdown containing a JSON table that bypasses sanitization filters. The attack requires user interaction (a targeted user must view the malicious table), but does not require elevated privileges. An attacker can induce a targeted user to perform unintended state-changing HTTP requests. Patches are available in GitLab CE/EE versions 19.1.8, 19.2.6, and 19.3.2.
Affected products
- GitLab GitLab Community Edition 15.3 to 19.1.7, 19.2.0 to 19.2.5, 19.3.0 to 19.3.1
- GitLab GitLab Enterprise Edition 15.3 to 19.1.7, 19.2.0 to 19.2.5, 19.3.0 to 19.3.1
Timeline
- 2026-09-16: disclosed
- 2026-09-10: patched: Patches released for versions 19.1.8, 19.2.6, and 19.3.2