CVE-2026-2973

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-2973
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.7 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an authenticated user to execute arbitrary JavaScript in a user's browser due to improper sanitization of entity-encoded content in Mermaid diagrams.

5.4 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://about.gitlab.com/releases/2026/03/25/patch-release-gitlab-18-10-1-released/ Release Notes Vendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/work_items/591049 Broken Link
https://hackerone.com/reports/3566802 Permissions Required
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*
cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*
cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*
cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*
cpe:2.3:a:gitlab:gitlab:18.10.0:*:*:*:community:*:*:*
cpe:2.3:a:gitlab:gitlab:18.10.0:*:*:*:enterprise:*:*:*
History

26 Mar 2026, 17:43

Type Values Removed Values Added
Summary
  • (es) GitLab ha remediado un problema en GitLab CE/EE que afecta a todas las versiones desde la 17.7 y anteriores a la 18.8.7, la 18.9 y anteriores a la 18.9.3, y la 18.10 y anteriores a la 18.10.1 que podría haber permitido a un usuario autenticado ejecutar JavaScript arbitrario en el navegador de un usuario debido a una sanitización incorrecta del contenido codificado por entidades en los diagramas de Mermaid.
References () https://about.gitlab.com/releases/2026/03/25/patch-release-gitlab-18-10-1-released/ - () https://about.gitlab.com/releases/2026/03/25/patch-release-gitlab-18-10-1-released/ - Release Notes, Vendor Advisory
References () https://gitlab.com/gitlab-org/gitlab/-/work_items/591049 - () https://gitlab.com/gitlab-org/gitlab/-/work_items/591049 - Broken Link
References () https://hackerone.com/reports/3566802 - () https://hackerone.com/reports/3566802 - Permissions Required
First Time Gitlab
Gitlab gitlab
CPE cpe:2.3:a:gitlab:gitlab:18.10.0:*:*:*:enterprise:*:*:*
cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*
cpe:2.3:a:gitlab:gitlab:18.10.0:*:*:*:community:*:*:*
cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*

25 Mar 2026, 17:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-25 17:16

Updated : 2026-03-26 17:43

NVD link : CVE-2026-2973

Mitre link : CVE-2026-2973

CVE.ORG link : CVE-2026-2973

JSON object : View

Products Affected

gitlab

  • gitlab
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')