This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.
[TLP:CLEAR] GitLab CE/EE fixes 15 vulnerabilities
GitLab fixes 15 vulnerabilities in GitLab Community Edition (CE) and Enterprise Edition (EE) with versions 18.9.2, 18.8.6 and 18.7.6 [1]. The most severe vulnerabilities are listed below.
Due to insufficient sanitization of placeholder variables when processing Markdown content, an authenticated remote attacker can carry out an XSS attack [1].
The vulnerability is present in products:
- GitLab Community Edition; >=10.6, <18.7.6; >=18.8, <18.8.6; >=18.9, < 18.9.2
- GitLab Enterprise Edition; >=10.6, <18.7.6; >=18.8, <18.8.6; >=18.9, < 18.9.2
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
More information:
- CVE-2026-1090 at cve.org, NVD
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org
The vulnerability was publicly disclosed 11. 3. 2026.
Due to uncontrolled recursion in the GraphQL API, an unauthenticated remote attacker can carry out a DoS attack by sending specially crafted requests [1].
The vulnerability is present in products:
- GitLab Community Edition; >=18.9, <18.9.2
- GitLab Enterprise Edition; >=18.9, <18.9.2
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
More information:
- CVE-2026-1069 at cve.org, NVD
- CWE-674: Uncontrolled Recursion at cwe.mitre.org
The vulnerability was publicly disclosed 11. 3. 2026.
An unauthenticated remote attacker can carry out a DoS attack by sending specially crafted requests to repository archive endpoints [1].
The vulnerability is present in products:
- GitLab Community Edition; >=10.0, <18.7.6; >=18.8, <18.8.6; >=18.9, <18.9.2
- GitLab Enterprise Edition; >=10.0, <18.7.6; >=18.8, <18.8.6; >=18.9, <18.9.2
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
More information:
- CVE-2025-13929 at cve.org, NVD
- CWE-770: Allocation of Resources Without Limits or Throttling at cwe.mitre.org
The vulnerability was publicly disclosed 11. 3. 2026.
Due to insufficient input validation when processing specially crafted JSON requests in the protected branches API, an unauthenticated remote attacker can carry out a DoS attack [1].
The vulnerability is present in products:
- GitLab Community Edition; >=16.11, <18.7.6; >=18.8, <18.8.6; >=18.9, <18.9.2
- GitLab Enterprise Edition; >=16.11, <18.7.6; >=18.8, <18.8.6; >=18.9, <18.9.2
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
More information:
- CVE-2025-14513 at cve.org, NVD
- CWE-1284: Improper Validation of Specified Quantity in Input at cwe.mitre.org
The vulnerability was publicly disclosed 11. 3. 2026.
By CESNET, z.s.p.o. Henrieta Paločková on 12. 3. 2026.