CVE-2026-1090
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
Summary
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
Original description
The description as published by the source.
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.6 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an authenticated user, when the markdown_placeholders feature flag was enabled, to inject JavaScript in a browser due to improper sanitization of placeholder content in markdown processing.
Affected packages
Bitnami
gitlab
[{"type":"SEMVER","events":[{"introduced":"10.6.0"},{"fixed":"18.7.6"},{"introduced":"18.8.0"},{"fixed":"18.8.6"},{"introduced":"18.9.0"},{"fixed":"18.9.2"}]}]
References
- advisory nvd.nist.gov
- advisory github.com
- package git://git@gitlab.com:gitlab-org/gitlab.git
- report hackerone.com
- web about.gitlab.com
- web gitlab.com