CVE-2026-78252

CVE-2026-78252 is an injection flaw (CWE-79) in GitLab CE/EE caused by improper sanitization of user-controlled data in the Markdown JSON table renderer. An authenticated attacker can craft Markdown content that, when a targeted user views it, causes the victim's browser to silently issue unintended state-changing HTTP requests, effectively performing actions as the victim (high confidentiality and integrity impact, reflected in the scope-changed CVSS 3.1 score of 8.2). All GitLab CE and EE deployments running versions from 15.3 before 19.1.8, 19.2 before 19.2.6, or 19.3 before 19.3.2 are affected. Exploitation requires an attacker account and victim interaction (CVSS AC:H/UI:R), and there is currently no public PoC, no CISA KEV listing, and no confirmed in-the-wild exploitation, although recent headlines have highlighted other critical GitLab flaws such as arbitrary file read and code execution.

What to do: Upgrade self-managed GitLab CE/EE to 19.1.8, 19.2.6, or 19.3.2 (or later) according to your current release train; GitLab.com is patched server-side. Because exploitation requires an authenticated attacker and victim interaction, interim mitigation includes restricting Markdown authoring to trusted users, and defenders should review audit logs for unexpected state-changing actions attributed to legitimate users.