CVE-2026-1090: GitLab CE/EE XSS Vulnerability

CVE-2026-1090 Overview

GitLab has remediated a Cross-Site Scripting (XSS) vulnerability in GitLab CE/EE affecting all versions from 10.6 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2. This vulnerability allows an authenticated user to inject JavaScript in a browser when the markdown_placeholders feature flag is enabled, due to improper sanitization of placeholder content in markdown processing.

Critical Impact

Authenticated attackers can execute arbitrary JavaScript in victim browsers, potentially leading to session hijacking, credential theft, and unauthorized actions on behalf of other GitLab users.

Affected Products

• GitLab CE/EE versions 10.6 through 18.7.5
• GitLab CE/EE versions 18.8.0 through 18.8.5
• GitLab CE/EE versions 18.9.0 through 18.9.1

Discovery Timeline

• 2026-03-11 - CVE-2026-1090 published to NVD
• 2026-03-11 - GitLab releases security patch (18.9.2, 18.8.6, 18.7.6)
• 2026-03-12 - Last updated in NVD database

Technical Details for CVE-2026-1090

Vulnerability Analysis

This vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), commonly known as Cross-Site Scripting (XSS). The issue stems from GitLab's markdown processing engine failing to properly sanitize user-supplied content within placeholder elements when the markdown_placeholders feature flag is enabled.

When an authenticated user crafts a malicious markdown payload containing JavaScript within placeholder syntax, the application processes and renders this content without adequate output encoding. This allows the injected script to execute in the context of other users' browser sessions when they view the affected content.

The vulnerability requires user interaction—a victim must view the page containing the malicious markdown—and the attacker must have authenticated access to the GitLab instance. However, the scope extends beyond the vulnerable component, as successful exploitation can impact the confidentiality and integrity of other users' sessions.

Root Cause

The root cause lies in insufficient input sanitization within GitLab's markdown rendering pipeline. Specifically, the markdown_placeholders feature introduces a parsing mechanism that fails to properly escape or filter JavaScript code embedded within placeholder content. When the markdown processor encounters placeholder syntax, it directly interpolates user-controlled content into the rendered HTML output without applying appropriate XSS protection measures such as HTML entity encoding or Content Security Policy enforcement.

Attack Vector

The attack is network-based and requires authenticated access to a GitLab instance where the markdown_placeholders feature flag is enabled. An attacker can inject malicious JavaScript by creating or editing content that uses markdown rendering, such as issues, merge request descriptions, comments, or wiki pages.

When a victim user navigates to a page containing the malicious markdown, the injected JavaScript executes within their browser session. This can lead to:

• Session hijacking through cookie theft
• Credential harvesting via fake login forms
• Privilege escalation by performing actions as the victim user
• Data exfiltration from private repositories or issues

The vulnerability documentation and technical details are available through the HackerOne Report #3502450 and GitLab Work Item #586478.

Detection Methods for CVE-2026-1090

Indicators of Compromise

• Unusual JavaScript patterns within markdown content in issues, merge requests, comments, or wiki pages
• Unexpected outbound network requests originating from GitLab pages in browser developer tools
• User reports of suspicious behavior when viewing specific GitLab content
• Anomalous API calls or actions performed by user accounts without their knowledge

Detection Strategies

• Review GitLab audit logs for suspicious content modifications, particularly in issues and merge requests
• Implement Content Security Policy (CSP) monitoring to detect inline script execution attempts
• Deploy web application firewall (WAF) rules to detect common XSS payload patterns in markdown content
• Monitor for unusual patterns in user session behavior that may indicate session hijacking

Monitoring Recommendations

• Enable GitLab audit logging and regularly review for anomalous markdown content creation or modification
• Implement browser-based XSS detection tools for users with administrative access
• Configure alerting for CSP violation reports indicating blocked script execution attempts
• Monitor authentication logs for session reuse from unexpected IP addresses or user agents

How to Mitigate CVE-2026-1090

Immediate Actions Required

• Upgrade GitLab CE/EE to patched versions: 18.9.2, 18.8.6, or 18.7.6
• If immediate patching is not possible, disable the markdown_placeholders feature flag
• Review recent markdown content changes for potential malicious payloads
• Advise users to clear browser sessions and re-authenticate after the patch is applied

Patch Information

GitLab has released security patches addressing this vulnerability. Organizations should upgrade to the following versions:

• GitLab 18.9.2 for installations on the 18.9.x branch
• GitLab 18.8.6 for installations on the 18.8.x branch
• GitLab 18.7.6 for installations on the 18.7.x branch or earlier supported versions

Detailed patch information is available in the GitLab Patch Release Announcement.

Workarounds

• Disable the markdown_placeholders feature flag via GitLab Rails console or application settings until patching is complete
• Implement stricter Content Security Policy headers to mitigate the impact of XSS attacks
• Restrict markdown rendering capabilities for untrusted users where possible
• Deploy a web application firewall with XSS filtering rules in front of GitLab instances

# Disable markdown_placeholders feature flag via Rails console
gitlab-rails console
Feature.disable(:markdown_placeholders)