What is the CVSS score of CVE-2026-2973?

CVE-2026-2973 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Gitlab are affected by CVE-2026-2973?

Organizations using GitLab CE/EE affecting all should be aware of moderate risk from CVE-2026-2973, a cross-site scripting vulnerability rated CVSS 5.4.. A patch is available.

Is there a public PoC exploit available for CVE-2026-2973?

Yes, a public proof-of-concept exploit is available for CVE-2026-2973. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-2973?

Within 30 days: Identify affected systems running GitLab CE/EE affecting all and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

Gitlab CVE-2026-2973

EUVD-2026-15809 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-25 GitLab

Gitlab XSS

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

18.10.1,18.9.3,18.8.7

PoC Detected

Mar 26, 2026 - 17:43 vuln.today

Public exploit code

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15809

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:34 nvd

MEDIUM 5.4

DescriptionCVE.org

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.7 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an authenticated user to execute arbitrary JavaScript in a user's browser due to improper sanitization of entity-encoded content in Mermaid diagrams.

AnalysisAI

This vulnerability is a stored cross-site scripting (XSS) flaw in GitLab's Mermaid diagram rendering that allows authenticated users to inject arbitrary JavaScript code into other users' browsers through improperly sanitized entity-encoded content. The vulnerability affects GitLab CE/EE versions 17.7 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1, with a CVSS score of 5.4 (medium severity). A public proof-of-concept exploit is available on HackerOne, indicating active awareness in the security community.

Technical ContextAI

The vulnerability exists in GitLab's Mermaid diagram parser, a popular JavaScript-based diagramming library used for rendering flowcharts, sequence diagrams, and other visual elements. The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation, aka Cross-site Scripting), which occurs when user-supplied input containing entity-encoded payloads is not properly sanitized before being rendered in the browser. Mermaid diagrams are processed server-side and embedded in web pages; the vulnerability arises from insufficient HTML entity decoding and escaping, allowing attackers to bypass sanitization filters by encoding malicious JavaScript within diagram syntax. The affected product is identified via CPE as cpe:2.3:a:gitlab:gitlab, with the flaw present across multiple major and minor versions of GitLab's Community and Enterprise editions.

RemediationAI

Immediately upgrade affected GitLab instances to version 18.10.1, 18.9.3, or 18.8.7 or later, depending on your current release track (see https://about.gitlab.com/releases/2026/03/25/patch-release-gitlab-18-10-1-released/). If immediate patching is not feasible, implement strict Content Security Policy (CSP) headers to restrict inline script execution and disable or restrict Mermaid diagram rendering in untrusted projects. Additionally, audit project documentation and merge requests for suspicious Mermaid diagram content, particularly those created or modified by external or newly-added collaborators. Enforce code review policies for documentation changes and consider temporarily disabling Mermaid rendering at the instance level until patches can be applied.