GitLab Patches 15 Security Flaws Including Critical XSS in Markdown Processing

GitLab has released critical security patches across three version branches — 18.9.2, 18.8.6, and 18.7.6 — addressing 15 vulnerabilities that affect both Community Edition and Enterprise Edition installations. The most severe issue, CVE-2026-1090, is a cross-site scripting vulnerability with a CVSS score of 8.7 that exploits a flaw in how GitLab processes Markdown placeholder elements.

The XSS Vulnerability

CVE-2026-1090 allows an attacker to bypass GitLab's HTML sanitization by crafting specific Markdown content that, when rendered, injects arbitrary JavaScript into the page. The attack requires the victim to view a page containing the malicious Markdown — such as an issue description, merge request comment, or wiki page. Successful exploitation could enable session hijacking, allowing the attacker to perform actions as the victim, including accessing private repositories and modifying code.

The vulnerability affects GitLab instances where users can create or edit Markdown content, which includes nearly all GitLab deployments. GitLab.com and GitLab Dedicated instances have already been patched.

Denial of Service Fixes

Three high-severity denial-of-service vulnerabilities, each rated CVSS 7.5, were also patched. CVE-2026-1069 targets the GraphQL API with queries that consume excessive server resources. CVE-2025-13929 affects the repository archive endpoint, where specially crafted requests can cause the server to generate enormous archive files. CVE-2025-14513 exploits the protected branches API to create resource exhaustion conditions.

All three DoS vulnerabilities can be triggered by authenticated users with minimal privileges, making them accessible to any registered user on public GitLab instances or any team member on private instances.

Upgrade Guidance

GitLab strongly recommends that all self-managed installations upgrade immediately to one of the patched versions. The security release follows GitLab's standard practice of publishing patches for the current and two previous minor versions, giving administrators flexibility in their upgrade path. Installations running versions older than 18.7 should plan an upgrade to a supported branch as soon as possible.