GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.2 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 that under certain circumstances, could ha

Code

The project this record applies to. Exploit listings stay in References.

• Repository · gitlab.com

Timeline

Detection, updates, and resolution for this record.

1. Feb 25, 2026 · GitLab Security Releases

   Detected

   On February 25, 2026, we released versions 18.9.1, 18.8.5, 18.7.5 for GitLab Community Edition (CE) and Enterprise Edition (EE). These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated customers do not need to ta

2. Jun 17, 2026 · NIST NVD

   Updated

   GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.2 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 that under certain circumstances, could have allowed an unauthenticated user to inject arbitrary scripts into the Mermaid sandbox UI.

Affected

• cpe gitlab/gitlabversion unspecified
• cpe gitlab/gitlab18.9.0

Sources

• GitLab Security ReleasesVendor advisoryCVE-2026-0752

  On February 25, 2026, we released versions 18.9.1, 18.8.5, 18.7.5 for GitLab Community Edition (CE) and Enterprise Edition (EE). These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of the

  docs.gitlab.com
• NIST NVDVulnerability recordCVE-2026-0752

  GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.2 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 that under certain circumstances, could have allowed an unauthenticated user to inject arbitrary scripts into the Mermaid sandbox UI.

  nvd.nist.gov

References

• Release Notes · about.gitlab.com
• Broken Link · gitlab.com
• Permissions Required · hackerone.com