GitLab
Moderate fix1 remedy
cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*, +2 more
Moderate fix1 remedy
- >= 18.11, < 18.11.1
GitLab CE/EE Input Validation Vulnerability in Mermaid Sandbox Allowing Cross-User Content Injection
Vulnerability
Patched
A vulnerability exists in GitLab CE/EE versions 18.11 prior to 18.11.1, where improper input validation in the Mermaid sandbox could have allowed an authenticated user to inject unauthorized content into another user's browser under certain conditions.
Impact
Exploitation of this vulnerability could lead to cross-user content injection, allowing an authenticated user to load unauthorized content into another user's browser.
Added: Apr 22, 2026, 5:23 PM
Updated: Apr 22, 2026, 5:23 PM
Vulnerability Rating
Custom Algorithm
spread
7.3impact
0.2exploitability
5.0remediation
7.7relevance
6.5threat
0.0urgency
2.9incentive
0.0Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.