Stored cross-site scripting in GitLab Enterprise Edition and Gitlab Community Edition - CVE-2026-2973
Published: March 25, 2026 / Updated: March 26, 2026
Vulnerability identifier: #VU124606
CSH Severity: Medium
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2026-2973
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary JavaScript in a user's browser.
The vulnerability exists due to improper sanitization of entity-encoded content in the Mermaid diagram renderer when rendering content. A remote user can inject malicious Mermaid diagrams containing encoded scripts, which when viewed by another user, execute arbitrary JavaScript in their browser.
Affected software
GitLab Enterprise Edition
Gitlab Community Edition
Gitlab Community Edition
How to mitigate CVE-2026-2973
Install security update from vendor's website.
GitLab Enterprise Edition - addressed in versions 18.8.7, 18.9.3, 18.10.1
Gitlab Community Edition - addressed in versions 18.8.7, 18.9.3, 18.10.1
Gitlab Community Edition - addressed in versions 18.8.7, 18.9.3, 18.10.1