CVE-2026-2973: GitLab Mermaid Diagram XSS Vulnerability

CVE-2026-2973 Overview

A stored Cross-Site Scripting (XSS) vulnerability has been identified in GitLab Community Edition (CE) and Enterprise Edition (EE) that affects all versions from 17.7 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1. This vulnerability allows an authenticated user to execute arbitrary JavaScript in a victim's browser due to improper sanitization of entity-encoded content in Mermaid diagrams.

Critical Impact

Authenticated attackers can inject malicious JavaScript through crafted Mermaid diagrams, potentially leading to session hijacking, credential theft, or unauthorized actions on behalf of legitimate users.

Affected Products

• GitLab Community Edition (CE) versions 17.7 to 18.8.6
• GitLab Enterprise Edition (EE) versions 17.7 to 18.8.6
• GitLab CE/EE versions 18.9.0 to 18.9.2
• GitLab CE/EE version 18.10.0

Discovery Timeline

• 2026-03-25 - CVE-2026-2973 published to NVD
• 2026-03-25 - GitLab releases security patch (versions 18.10.1, 18.9.3, 18.8.7)
• 2026-03-26 - Last updated in NVD database

Technical Details for CVE-2026-2973

Vulnerability Analysis

This vulnerability stems from improper sanitization of entity-encoded content within Mermaid diagrams in GitLab. Mermaid is a JavaScript-based diagramming tool that GitLab uses to render diagrams from text in Markdown files, issues, merge requests, and wikis. The XSS vulnerability occurs when the sanitization logic fails to properly handle HTML entity-encoded payloads, allowing attackers to bypass input filtering mechanisms.

When a user views a page containing a maliciously crafted Mermaid diagram, the entity-encoded JavaScript payload is decoded and executed in the context of the victim's browser session. This can compromise the confidentiality and integrity of user data without causing a denial of service condition.

Root Cause

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). GitLab's content sanitization for Mermaid diagrams did not adequately handle entity-encoded characters, allowing attackers to craft payloads that bypass the sanitization filters. When the browser renders the diagram, these entity-encoded sequences are decoded back to their original characters, resulting in executable JavaScript code.

Attack Vector

The attack requires network access and an authenticated user account on the GitLab instance. The attacker must craft a Mermaid diagram containing entity-encoded JavaScript and embed it in content visible to other users, such as:

• Issue descriptions or comments
• Merge request descriptions
• Wiki pages
• Repository Markdown files

When a victim user views the page containing the malicious diagram, the JavaScript executes in their browser context. The attack changes scope (indicated by the changed scope metric), meaning the vulnerability can affect resources beyond the vulnerable component. User interaction is required as the victim must navigate to the page containing the malicious content.

The vulnerability mechanism exploits the difference between server-side sanitization and client-side rendering. Entity-encoded characters like < (representing <) may pass through server-side filters that look for literal angle brackets, but are decoded by the browser during rendering. For detailed technical information, refer to the HackerOne Report #3566802 and GitLab Work Item #591049.

Detection Methods for CVE-2026-2973

Indicators of Compromise

• Mermaid diagram blocks in issues, merge requests, or wikis containing unusual entity-encoded sequences
• User reports of unexpected browser behavior or redirects when viewing specific GitLab pages
• Audit logs showing suspicious activity from user sessions that may have been hijacked
• Presence of HTML entity patterns like &#x or < within Mermaid code blocks

Detection Strategies

• Implement content security policy (CSP) headers to detect and prevent inline script execution
• Monitor web application firewall (WAF) logs for patterns indicating XSS attempts in diagram content
• Review GitLab audit logs for suspicious user activities that may indicate compromised sessions
• Scan repository content and issue databases for Mermaid blocks containing entity-encoded HTML characters

Monitoring Recommendations

• Enable browser-based XSS detection alerts through CSP violation reporting
• Configure WAF rules to flag requests containing entity-encoded JavaScript patterns
• Implement session anomaly detection to identify potential session hijacking
• Regularly audit user-generated content containing Mermaid diagrams for suspicious patterns

How to Mitigate CVE-2026-2973

Immediate Actions Required

• Upgrade GitLab CE/EE to version 18.10.1, 18.9.3, or 18.8.7 immediately
• Review recent Mermaid diagram content in issues, merge requests, and wikis for potential exploitation attempts
• Consider temporarily disabling Mermaid diagram rendering if immediate patching is not possible
• Implement or strengthen Content Security Policy headers to mitigate XSS impact

Patch Information

GitLab has released patched versions addressing this vulnerability. Organizations should upgrade to one of the following fixed versions based on their current deployment:

For complete patch details and upgrade instructions, see the GitLab Patch Release Announcement.

Workarounds

• Deploy a Web Application Firewall (WAF) with rules to block entity-encoded XSS patterns
• Implement strict Content Security Policy headers including script-src 'self' to prevent inline script execution
• Disable Mermaid diagram rendering through GitLab configuration if the feature is not essential
• Restrict repository and issue creation permissions to trusted users until patching is complete

# Example: Add CSP headers via GitLab's nginx configuration
# Edit /etc/gitlab/gitlab.rb and add:
nginx['custom_gitlab_server_config'] = "add_header Content-Security-Policy \"default-src 'self'; script-src 'self'; object-src 'none';\";"

# Reconfigure GitLab to apply changes
sudo gitlab-ctl reconfigure