What is the CVSS score of CVE-2026-1606?

CVE-2026-1606 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-1606?

Yes, a patch is available for CVE-2026-1606. Update the affected software to the latest version immediately.

GitLab CE/EE CVE-2026-1606

EUVD-2026-39178 MEDIUM

Code Injection (CWE-94)

2026-06-25 cve@gitlab.com

GHSA-vxf7-7c9g-m3x8

RCE Gitlab Code Injection

4.3

CVSS 3.1 · Vendor: gitlab

Severity by source

Vendor (gitlab) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network-reachable Snippet feature requires only low-privilege authentication; impact limited to content integrity with no confidentiality or availability loss confirmed.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (gitlab).

CVSS VectorVendor: gitlab

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Jun 25, 2026 - 07:01 EUVD

Analysis Generated

Jun 25, 2026 - 05:33 vuln.today

DescriptionCVE.org

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.8 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed an authenticated user to conceal content within a Snippet due to improper input validation.

AnalysisAI

Content injection in GitLab CE/EE via improper Snippet input validation permits authenticated low-privilege users to conceal arbitrary content within Snippets, affecting all versions from 14.8 through 19.1.0. Despite being tagged as Code Injection (CWE-94) with RCE in vendor-supplied tags, the published CVSS score of 4.3 with only low integrity impact (I:L) indicates the vendor-confirmed impact is scoped to content concealment rather than full remote code execution. Patches are available in versions 18.11.6, 19.0.3, and 19.1.1; no public exploit and no CISA KEV listing have been identified at time of analysis.

Technical ContextAI

GitLab CE/EE's Snippet feature allows users to share code fragments and text content, similar to GitHub Gists. The vulnerability is rooted in CWE-94 (Improper Control of Generation of Code), which classifies flaws where software fails to sufficiently neutralize user-controllable content before it is processed or rendered. In this context, the improper input validation allows a user to inject or structure Snippet content in a way that conceals portions of it from normal view, potentially hiding malicious payloads or misleading other users reviewing the Snippet. The CPE data is not explicitly provided, but the affected range spans GitLab CE and EE across versions 14.8 through pre-18.11.6, pre-19.0.3, and pre-19.1.1, representing a very wide installation base. The HackerOne report (https://hackerone.com/reports/3527473) and the GitLab work item (https://gitlab.com/gitlab-org/gitlab/-/work_items/588128) provide additional upstream context for the underlying mechanism.

RemediationAI

The primary remediation is to upgrade to one of the vendor-released patched versions: 18.11.6, 19.0.3, or 19.1.1, as documented in the GitLab patch advisory at https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-1-1-released/. Organizations running versions in the 14.8-18.11.5 range should upgrade to 18.11.6 or later. Those on 19.0.x should upgrade to 19.0.3, and those on 19.1.0 should upgrade to 19.1.1. If immediate patching is not feasible, a compensating control is to disable or restrict access to the Snippets feature - GitLab administrators can control Snippet visibility and creation permissions at the instance or group level, which would prevent exploitation by limiting who can create or modify Snippets. This control has a usability trade-off for teams relying on Snippets for code sharing workflows.