Loading vulnerability…
HTML Injection in GitLab wiki markup rendering
CVE-2026-13320 is a high-severity input neutralization flaw in GitLab Community Edition and Enterprise Edition wiki markup rendering. Affecting GitLab CE/EE versions from 15.7 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2, the issue stems from improper sanitization of user-supplied input during web page generation, specifically in wiki markup rendering. Under certain conditions, a remote authenticated user can inject HTML that results in arbitrary script execution in another user's browser session.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows execution of attacker-controlled script in the victim user's browser session in the GitLab application context. This can enable cross-site scripting outcomes such as session hijacking, unauthorized actions performed as the victim, access to data visible to the victim in the application, and broader compromise of the victim's interaction with GitLab.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure by limiting access to affected GitLab instances to trusted authenticated users, restricting the ability to create or modify wiki content where feasible, and closely monitoring for suspicious content injection or anomalous user-session activity. These measures are temporary risk-reduction steps and do not eliminate the underlying vulnerability; upgrading to a fixed version is the effective mitigation.
Patch, then assume compromise.
Upgrade GitLab CE/EE to a fixed release. Patched versions include 18.11.7, 19.0.4, and 19.1.2. Self-managed deployments on affected versions should be updated immediately to one of these releases or a later fixed version in the relevant supported branch.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.