GitLab contains a flaw where entity‑encoded content inside Mermaid diagrams is not properly sanitized. An authenticated user who can add or edit a diagram can inject arbitrary JavaScript. If another user views the diagram, the script runs in the victim’s browser, allowing the attacker to execute code on the victim’s behalf.

The vulnerability affects GitLab Community Edition and Enterprise Edition for all releases from version 17.7 up to—but not including—18.8.7, all 18.9 releases prior to 18.9.3, and the 18.10 release prior to 18.10.1. Upgrading to 18.8.7, 18.9.3, 18.10.1 or later removes the flaw.

The CVSS score of 5.4 indicates a moderate severity, and the EPSS score of less than 1% reflects a low likelihood of exploitation in the wild. The vulnerability does not appear in the CISA KEV catalog. Exploitation requires the attacker to have authenticated access to the GitLab instance and the ability to create or modify a Mermaid diagram that is subsequently viewed by other users.