MEDIUM

CVE-2026-1282

Gitlab GitLab 2026-02-11 CVSS v3.1

CVSS

5.4

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that could have allowed an authenticated user to inject malicious content into project labels titles.

Summary dbcve.org

This is a stored Cross-Site Scripting (XSS) vulnerability in GitLab CE/EE where an authenticated user can inject malicious JavaScript content into project label titles. The malicious payload persists in the database and executes when other users view the affected labels.

Mitigation

Upgrade GitLab to version 18.6.6, 18.7.4, 18.8.4 or later. As a temporary mitigation, restrict label creation permissions to trusted users only until the upgrade is completed.

Weakness (CWE)

CWE-80

EPSS Score

0.17%

Probability of exploitation in next 30 days

6.6th percentile

References

https://about.gitlab.com/releases/2026/02/10/patch-release-gitlab-18-8-4-released/ Release Notes, Vendor Advisory https://gitlab.com/gitlab-org/gitlab/-/issues/587106 Broken Link, Issue Tracking https://hackerone.com/reports/3505596 Permissions Required

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE