widely-deployed-product-advisoryinternet-facing-service-vulnerability

GitLab Patches XSS and API Denial-of-Service Vulnerabilities in CE/EE

Patch & Detection Intelligence · 3 sources · Updated 4mo ago · First seen Mar 12, 2026

GitLab released security updates for GitLab Community Edition (CE) and Enterprise Edition (EE), shipping patched versions 18.9.2, 18.8.6, and 18.7.6 to address multiple vulnerabilities affecting self-managed deployments. The Canadian Centre for Cyber Security issued advisory AV26-222 urging organizations to review GitLab’s upstream advisory and apply the updates for any instances running versions prior to those releases.

The update fixes 15 security issues, including a high-severity XSS vulnerability (CVE-2026-1090, CVSS 8.7) in Markdown placeholder processing when the relevant feature flag is enabled, which could allow an authenticated attacker to inject malicious JavaScript into a victim’s browser. GitLab also addressed several denial-of-service conditions, including issues impacting the GraphQL API (resource exhaustion via recursion), repository archive endpoints, and JSON payload validation in the protected branches API; additional fixes include webhook-related DoS risks (e.g., CVE-2025-13690, CVE-2025-12576) and a CRLF sequence handling issue (CVE-2026-3848).

Patch this, or something else?See real exploitation activity before you spend the cycle.

Triage this advisory

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

2 events · Mar 11, 2026 – Mar 12, 2026

Mar 12, 20268mo ago
Details disclosed on XSS and API DoS flaws fixed in the GitLab update
Public reporting identified the most critical issue as CVE-2026-1090, an authenticated XSS in Markdown placeholder processing, along with multiple high-severity API-related denial-of-service flaws. The reports also noted GitLab.com and GitLab Dedicated were already patched and that detailed vulnerability reports would be published 30 days after release.
Mar 11, 20268mo ago
GitLab publishes security advisory and patched CE/EE releases
On 2026-03-11, GitLab published a security advisory for GitLab Community Edition and Enterprise Edition covering 15 vulnerabilities. It released patched versions 18.9.2, 18.8.6, and 18.7.6 for affected versions prior to those releases.

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

1 linked

Cross-site Scripting in GitLab CE/EE Markdown Placeholder Processing (CVE-2026-1090)

Affected products

2 linked

Gitlab Community EditionGitlab Enterprise Edition

Do you run this?See real exploitation activity behind this advisory so you can triage it against everything else in the queue.

Prioritize This Patch

Source coverage

Sources

3 references tracked. Mallory keeps watching after this page renders.

Belgium Ccb Security AdvisoriesNews · Mar 27, 2026

Warning: Multiple High severity vulnerabilities in GitLab, Patch Immediately! | CCB SafeonwebOpen source ↗

Cyber Security NewsNews · Mar 12, 2026

GitLab Security Update - Patch for XSS and API DoS VulnerabilitiesOpen source ↗

Ca CcsNews · Mar 11, 2026

GitLab security advisory (AV26-222) - Canadian Centre for Cyber SecurityOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

GitLab Patches XSS and API Denial-of-Service Vulnerabilities in CE/EE

How this story unfolded

Details disclosed on XSS and API DoS flaws fixed in the GitLab update

GitLab publishes security advisory and patched CE/EE releases

Related entities

Vulnerabilities

Affected products

Sources

See the full picture, correlated to your attack surface.

Related stories

GitLab Security Update Fixes Web IDE Token Theft and DoS Vulnerabilities

GitLab Patches XSS and Unauthenticated DoS Flaws in Self-Managed CE and EE

GitLab patches high-severity XSS and authorization bypass flaws in CE/EE

GitLab Patches XSS and API Denial-of-Service Vulnerabilities in CE/EE

How this story unfolded

Details disclosed on XSS and API DoS flaws fixed in the GitLab update

GitLab publishes security advisory and patched CE/EE releases

Related entities

Vulnerabilities

Affected products

Sources

See the full picture, correlated to your attack surface.

Related stories

GitLab Security Update Fixes Web IDE Token Theft and DoS Vulnerabilities

GitLab Patches XSS and Unauthenticated DoS Flaws in Self-Managed CE and EE

GitLab patches high-severity XSS and authorization bypass flaws in CE/EE