CVE-2026-3254

LowCVSS 3.5/10Last modified Nov 11, 2026

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.11 before 18.11.1 that under certain conditions could have allowed an authenticated user to load unauthorized content into another user's browser due to improper input validation in the Mermaid sandbox.

Metrics

CVSS 3.1 3.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-1021

Affected software

Vendor	Product	Versions
GitLab	GitLab	>= 18.11, < 18.11.1

References

https://gitlab.com/gitlab-org/gitlab/-/work_items/591587Broken Link
https://hackerone.com/reports/3572752Permissions Required

Timeline

Published: Apr 22, 2026
Last modified: Nov 11, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-325407.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bookly Bookly bookly-responsive-appoin CVE-2026-325416.5Missing Authorization vulnerability in Premmerce Premmerce Redirect Manager premmerce-redirect-manager allows Exploiting Incorrectly Configu CVE-2026-325427.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeFusion Fusion Builder fusion-buil CVE-2026-325435.3Missing Authorization vulnerability in CyberChimps Responsive Blocks responsive-block-editor-addons allows Exploiting Incorrectly Configured CVE-2026-325447.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OOPSpam Team OOPSpam Anti-Spam oopspam CVE-2026-325457.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Taboola Taboola Pixel taboola-pixel al CVE-2026-325467.5Missing Authorization vulnerability in StellarWP Restrict Content restrict-content allows Exploiting Incorrectly Configured Access Control S CVE-2026-325477.1Unauthenticated Cross Site Scripting (XSS) in BP Better Messages <= 2.15.22 versions.CVE-2026-325485.3Unauthenticated Broken Access Control in SureCart <= 4.6.2 versions.CVE-2026-325497.5Unauthenticated Broken Access Control in ThumbPress < 6.5 versions.CVE-2026-32556.5HTTP::Session2 versions before 1.12 for Perl for Perl may generate weak session ids using the rand() function. The HTTP::Session2 session i CVE-2026-325508.5Subscriber SQL Injection in Kadence Shop Kit <= 3.0.6 versions.