Back to overview

CVE-2026-1606

MEDIUM
4.3
CVSS 3.1
Description
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.8 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed an authenticated user to conceal content within a Snippet due to improper input validation.

Metadata

CVE ID
CVE-2026-1606
State
PUBLISHED
Assigner
GitLab
Reserved
2026-01-29 11:33 UTC
Published
2026-06-25 04:34 UTC
Last updated
2026-06-25 04:34 UTC
Primary CWE
CWE-94
CWE-94: Improper Control of Generation of Code ('Code Inject…
Vendor / Product
GitLab / GitLab
Sources
cve.org  ·  NVD

Severity & Metrics

4.3 MEDIUM CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Affected products (1)
VendorProductPlatformVersions
GitLab GitLab — 14.8 < 18.11.6, 19.0 < 19.0.3, 19.1 < 19.1.1
Weakness (CWE)
CWESourceDescription
CWE-94 cna CWE-94: Improper Control of Generation of Code ('Code Injection')
CVSS scores (1)
ScoreSeverityVersionSourceVector
4.3 MEDIUM 3.1 cna CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
References (3)
Back to overview