PT-2026-24713 · Gitlab · Gitlab Ce/Ee

Yvvdwff · Published 2026-03-11 · Updated 2026-03-15 · CVE-2026-1090

Positive Technologies (AI Summary)

CVSS v3.1

8.7

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 10.6 through 18.7.5 GitLab CE/EE versions 18.8 through 18.8.5 GitLab CE/EE versions 18.9 through 18.9.1

Description GitLab CE/EE is affected by an issue that could allow an authenticated user to inject JavaScript into a browser. This occurs when the markdown placeholders feature flag is enabled due to improper sanitization of placeholder content during markdown processing. The issue affects versions from 10.6 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2. The vulnerability allows for the injection of JavaScript through the processing of markdown content. The vulnerable component is related to the handling of placeholder content within markdown.

Recommendations GitLab CE/EE versions 10.6 through 18.7.5 should be updated to version 18.7.6 or later. GitLab CE/EE versions 18.8 through 18.8.5 should be updated to version 18.8.6 or later. GitLab CE/EE versions 18.9 through 18.9.1 should be updated to version 18.9.2 or later.

Exploit

Fix

DoS

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2026-03436

BIT-GITLAB-2026-1090

CVE-2026-1090

Affected Products

Gitlab Ce/Ee

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/1xxx/CVE-2026-1090.json · Exploit
• 🔥 https://hackerone.com/reports/3502450 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-1090 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-1090 · Vendor Advisory
• https://about.gitlab.com/releases/2026/03/11/patch-release-gitlab-18-9-2-released · Vendor Advisory
• https://osv.dev/vulnerability/BIT-gitlab-2026-1090 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-1090 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-03436 · Security Note
• https://ubuntu.com/security/CVE-2026-1090 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-1090 · Security Note
• https://gitlab.com/gitlab-org/gitlab/-/work_items/586478 · Note
• https://twitter.com/the_yellow_fall/status/2031909180169146559 · Twitter Post
• https://twitter.com/TheHackerWire/status/2031772132167094337 · Twitter Post
• https://twitter.com/CCBalert/status/2032141713913922025 · Twitter Post
• https://twitter.com/CVEnew/status/2032998319245451712 · Twitter Post