This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.
[TLP:CLEAR] GitLab CE/EE fixes 9 vulnerabilities
GitLab fixes 9 vulnerabilities in GitLab Community Edition (CE) and Enterprise Edition (EE) with versions 18.9.1, 18.8.5 and 18.7.5 [1]. The most severe ones are listed below.
Under certain circumstances, an unauthenticated remote attacker can carry out an XSS attack in the Mermaid sandbox functionality [1].
The vulnerability is present in products:
- GitLab Community Edition; >=16.2.0, <18.7.5; >=18.8.0, <18.8.5; >=18.9.0, <18.9.1
- GitLab Enterprise Edition; >=16.2.0, <18.7.5; >=18.8.0, <18.8.5; >=18.9.0, <18.9.1
CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
More information:
- CVE-2026-0752 at cve.org, NVD
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org
The vulnerability was publicly disclosed 25. 2. 2026.
Under certain circumstances, an unauthenticated remote attacker can carry out a DoS attack in the container image registry functionality by sending specially crafted files [1].
The vulnerability is present in products:
- GitLab Community Edition; >=12.2.0, <18.7.5; >=18.8.0, <18.8.5; >=18.9.0, <18.9.1
- GitLab Enterprise Edition; >=12.2.0, <18.7.5; >=18.8.0, <18.8.5; >=18.9.0, <18.9.1
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
More information:
- CVE-2025-14511 at cve.org, NVD
- CWE-1284: Improper Validation of Specified Quantity in Input at cwe.mitre.org
The vulnerability was publicly disclosed 25. 2. 2026.
An unauthenticated remote attacker can carry out a DoS attack by sending specially crafted requests to the Jira events endpoint [1].
The vulnerability is present in products:
- GitLab Community Edition; >=14.4.0, <18.7.5; >=18.8.0, <18.8.5; >=18.9.0, <18.9.1
- GitLab Enterprise Edition; >=14.4.0, <18.7.5; >=18.8.0, <18.8.5; >=18.9.0, <18.9.1
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
More information:
- CVE-2026-1662 at cve.org, NVD
- CWE-770: Allocation of Resources Without Limits or Throttling at cwe.mitre.org
The vulnerability was publicly disclosed 25. 2. 2026.
Due to insufficient limits on regular expression processing in the merge request functionality, an unauthenticated remote attacker can carry out a DoS attack [1].
The vulnerability is present in products:
- GitLab Community Edition; >=9.2.0, <18.7.5; >=18.8.0, <18.8.5; >=18.9.0, <18.9.1
- GitLab Enterprise Edition; >=9.2.0, <18.7.5; >=18.8.0, <18.8.5; >=18.9.0, <18.9.1
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
More information:
- CVE-2026-1388 at cve.org, NVD
- CWE-1333: Inefficient Regular Expression Complexity at cwe.mitre.org
The vulnerability was publicly disclosed 25. 2. 2026.
By CESNET, z.s.p.o. Henrieta Paločková on 26. 2. 2026.