Loading vulnerability…
HTML Injection in GitLab CE/EE Test Case Titles
CVE-2026-0595 is an HTML injection vulnerability in GitLab Community Edition and Enterprise Edition test case titles. It affects all versions from 13.9 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4. Under certain conditions, an authenticated user can inject HTML through a test case title in a way that causes unauthorized email addresses to be added to another user's account. The flaw is rooted in insufficient neutralization of user-controlled input rendered in the application interface, enabling manipulation of account-related actions through injected markup.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can compromise account integrity by allowing an attacker to associate unauthorized email addresses with victim accounts. This may enable abuse of email-based account workflows and could create a path toward unauthorized account access or takeover, depending on how email verification and recovery mechanisms are configured and used in the affected deployment.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure by limiting access to authenticated users who can create or modify test case titles, closely monitoring account email-address changes for unauthorized additions, and reviewing audit trails for suspicious account-modification activity. These measures are temporary risk-reduction steps and do not eliminate the underlying vulnerability.
Patch, then assume compromise.
Upgrade GitLab CE/EE to a fixed release. The issue is remediated in 18.6.6, 18.7.4, and 18.8.4. Self-managed deployments should update to the appropriate patched version as soon as possible. GitLab.com was already patched at the time of disclosure.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.