PT-2026-34522 · Gitlab · Gitlab Ce/Ee

Published 2026-04-22 · Updated 2026-04-24 · CVE-2026-3254

Positive Technologies (AI Summary)

CVSS v3.1

3.5

Low

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 18.11 through 18.11.0

Description Improper input validation in the Mermaid sandbox could allow an authenticated user to load unauthorized content into another user's browser.

Recommendations Update to version 18.11.1.

Exploit

Fix

Clickjacking

Weakness Enumeration

CWE-1021

Related Identifiers

BIT-GITLAB-2026-3254

CVE-2026-3254

Affected Products

Gitlab Ce/Ee

References · 5

• 🔥 https://hackerone.com/reports/3572752 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-3254 · Security Note
• https://osv.dev/vulnerability/BIT-gitlab-2026-3254 · Vendor Advisory
• https://gitlab.com/gitlab-org/gitlab/-/work_items/591587 · Note
• https://twitter.com/CVEnew/status/2047012068797432233 · Twitter Post