Loading vulnerability…
Cross-site Scripting in GitLab CE/EE Markdown Placeholder Processing
CVE-2026-1090 is a high-severity cross-site scripting vulnerability in GitLab Community Edition and Enterprise Edition. The flaw affects GitLab CE/EE versions from 10.6 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2. It is caused by improper sanitization of placeholder content during markdown processing when the markdown_placeholders feature flag is enabled. Under those conditions, an authenticated user can inject attacker-controlled JavaScript that executes in another user’s browser in the context of the GitLab application. The issue is classified as CWE-79.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows execution of malicious JavaScript in a victim’s browser within the GitLab application context. This can enable session hijacking, unauthorized actions performed as the victim, access to sensitive data exposed to the victim’s session, and compromise of confidentiality and integrity within the affected GitLab instance. Available information indicates high confidentiality and integrity impact, with no direct availability impact from this flaw itself.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure by disabling the markdown_placeholders feature flag where operationally feasible, since the vulnerable condition requires that feature to be enabled. Limit access to authenticated users only as appropriate, monitor for suspicious markdown content and anomalous browser-side behavior in GitLab workflows, and prioritize expedited upgrade to a fixed release because no complete mitigation equivalent to patching is described.
Patch, then assume compromise.
Upgrade GitLab CE/EE to a fixed version. The vulnerability is remediated in GitLab 18.7.6, 18.8.6, and 18.9.2. Self-managed deployments running affected versions should update to the appropriate patched release as soon as possible. The vendor noted that these patch releases include database migrations, which may require downtime on single-node deployments; multi-node deployments can follow zero-downtime upgrade procedures where supported.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.