CVE-2026-1282

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1282", "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "state": "PUBLISHED", "assignerShortName": "GitLab", "dateReserved": "2026-01-21T06:33:13.239Z", "datePublished": "2026-02-11T11:04:25.235Z", "dateUpdated": "2026-02-11T21:18:14.189Z"}, "containers": {"cna": {"title": "Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in GitLab", "descriptions": [{"lang": "en", "value": "GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that could have allowed an authenticated user to inject malicious content into project labels titles."}], "affected": [{"vendor": "GitLab", "product": "GitLab", "repo": "git://git@gitlab.com:gitlab-org/gitlab.git", "cpes": ["cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"], "versions": [{"version": "18.6", "status": "affected", "lessThan": "18.6.6", "versionType": "semver"}, {"version": "18.7", "status": "affected", "lessThan": "18.7.4", "versionType": "semver"}, {"version": "18.8", "status": "affected", "lessThan": "18.8.4", "versionType": "semver"}], "defaultStatus": "unaffected"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)", "cweId": "CWE-80", "type": "CWE"}]}], "references": [{"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/587106", "name": "GitLab Issue #587106", "tags": ["issue-tracking", "permissions-required"]}, {"url": "https://hackerone.com/reports/3505596", "name": "HackerOne Bug Bounty Report #3505596", "tags": ["technical-description", "exploit", "permissions-required"]}, {"url": "https://about.gitlab.com/releases/2026/02/10/patch-release-gitlab-18-8-4-released/"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseScore": 3.5, "baseSeverity": "LOW"}}], "solutions": [{"lang": "en", "value": "Upgrade to versions 18.6.6, 18.7.4, 18.8.4 or above."}], "credits": [{"lang": "en", "value": "Thanks [rafabd1](https://hackerone.com/rafabd1) for reporting this vulnerability through our HackerOne bug bounty program", "type": "finder"}], "providerMetadata": {"orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "shortName": "GitLab", "dateUpdated": "2026-02-11T11:04:25.235Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-11T21:17:39.718106Z", "id": "CVE-2026-1282", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-11T21:18:14.189Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1282", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-11T21:17:39.718106Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-11T21:17:43.085Z"}}], "cna": {"title": "Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in GitLab", "credits": [{"lang": "en", "type": "finder", "value": "Thanks [rafabd1](https://hackerone.com/rafabd1) for reporting this vulnerability through our HackerOne bug bounty program"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.5, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"], "repo": "git://git@gitlab.com:gitlab-org/gitlab.git", "vendor": "GitLab", "product": "GitLab", "versions": [{"status": "affected", "version": "18.6", "lessThan": "18.6.6", "versionType": "semver"}, {"status": "affected", "version": "18.7", "lessThan": "18.7.4", "versionType": "semver"}, {"status": "affected", "version": "18.8", "lessThan": "18.8.4", "versionType": "semver"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Upgrade to versions 18.6.6, 18.7.4, 18.8.4 or above."}], "references": [{"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/587106", "name": "GitLab Issue #587106", "tags": ["issue-tracking", "permissions-required"]}, {"url": "https://hackerone.com/reports/3505596", "name": "HackerOne Bug Bounty Report #3505596", "tags": ["technical-description", "exploit", "permissions-required"]}, {"url": "https://about.gitlab.com/releases/2026/02/10/patch-release-gitlab-18-8-4-released/"}], "descriptions": [{"lang": "en", "value": "GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that could have allowed an authenticated user to inject malicious content into project labels titles."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-80", "description": "CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)"}]}], "providerMetadata": {"orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "shortName": "GitLab", "dateUpdated": "2026-02-11T11:04:25.235Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1282", "state": "PUBLISHED", "dateUpdated": "2026-02-11T21:18:14.189Z", "dateReserved": "2026-01-21T06:33:13.239Z", "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "datePublished": "2026-02-11T11:04:25.235Z", "assignerShortName": "GitLab"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "product": "GitLab", "repo": "git://git@gitlab.com:gitlab-org/gitlab.git", "vendor": "GitLab", "versions": [{"lessThan": "18.6.6", "status": "affected", "version": "18.6", "versionType": "semver"}, {"lessThan": "18.7.4", "status": "affected", "version": "18.7", "versionType": "semver"}, {"lessThan": "18.8.4", "status": "affected", "version": "18.8", "versionType": "semver"}]}], "source": "cve@gitlab.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "matchCriteriaId": "C3F7C278-FF2A-49DE-AE73-6B94C9833230", "versionEndExcluding": "18.6.6", "versionStartIncluding": "18.6.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "22C1B676-A5D2-40E7-8399-CFB9BCEEDE92", "versionEndExcluding": "18.6.6", "versionStartIncluding": "18.6.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "matchCriteriaId": "EB4484C1-2D91-48A6-B396-4F16DC598828", "versionEndExcluding": "18.7.4", "versionStartIncluding": "18.7.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "DA7B13F4-05B9-436E-A1DC-6C65DB7B44FE", "versionEndExcluding": "18.7.4", "versionStartIncluding": "18.7.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "matchCriteriaId": "BCEB62DB-0D85-4A21-99C4-6235CA97A795", "versionEndExcluding": "18.8.4", "versionStartIncluding": "18.8.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "6D01D64A-0619-427D-B351-4101FC257674", "versionEndExcluding": "18.8.4", "versionStartIncluding": "18.8.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that could have allowed an authenticated user to inject malicious content into project labels titles."}, {"lang": "es", "value": "GitLab ha remediado un problema en GitLab CE/EE que afectaba a todas las versiones desde la 18.6 y anteriores a la 18.6.6, la 18.7 y anteriores a la 18.7.4, y la 18.8 y anteriores a la 18.8.4 que podr\u00eda haber permitido a un usuario autenticado inyectar contenido malicioso en los t\u00edtulos de las etiquetas de proyecto."}], "id": "CVE-2026-1282", "lastModified": "2026-06-17T10:15:26.900", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.5, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 1.4, "source": "cve@gitlab.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1282", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-11T21:17:39.718106Z", "version": "2.0.3"}}]}, "published": "2026-02-11T12:16:04.403", "references": [{"source": "cve@gitlab.com", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://about.gitlab.com/releases/2026/02/10/patch-release-gitlab-18-8-4-released/"}, {"source": "cve@gitlab.com", "tags": ["Broken Link", "Issue Tracking"], "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/587106"}, {"source": "cve@gitlab.com", "tags": ["Permissions Required"], "url": "https://hackerone.com/reports/3505596"}], "sourceIdentifier": "cve@gitlab.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-80"}], "source": "cve@gitlab.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[18.6,18.6.6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[18.7,18.7.4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[18.8,18.8.4)"}}], "product": "gitlab", "vendor": "gitlab"}], "analysis": {"en": {"generated_at": "2026-04-18T12:41:35.106054+00:00", "value": {"mitigation_remediation": ["Upgrade GitLab to version 18.6.6, 18.7.4, 18.8.4 or later to remove the vulnerability.", "Ensure that all GitLab components that allow project label creation are running the patched version.", "Limit label editing rights to trusted personnel and monitor for anomalous changes to detect potential exploitation."], "summary": {"action": "Apply Patch", "impact": "Cross\u2011Site Scripting via Project Label Titles"}, "threat_synthesis": {"affected_systems": "Affected products include GitLab Community Edition and Enterprise Edition. All releases prior to 18.6.6, 18.7.4, and 18.8.4 are vulnerable.", "description_and_impact": "The vulnerability allows an authenticated user to inject arbitrary HTML or script content into project label titles, enabling basic cross\u2011site scripting attacks. The flaw is a classic example of improper neutralization of script\u2011related HTML tags (CWE\u201180).", "risk_and_exploitability": "The CVSS score of 3.5 indicates a moderate severity, and the EPSS value below 1% suggests exploitation is unlikely at present. The flaw requires the attacker to have authentication, and it is not catalogued in the CISA KEV database. The impact is confined to users who can modify label titles in their projects. Based on the description, the attack vector appears to be client\u2011side, requiring authentication."}}}}, "created": "2026-02-11T21:45:47.913563+00:00", "updated": "2026-04-18T12:45:45.673730+00:00", "vendors": ["gitlab", "gitlab$PRODUCT$gitlab"]}