CVE-2026-3254

BRIEFING NOTE: CVE-2026-3254 CVE-2026-3254 is an input validation flaw in GitLab Community Edition and Enterprise Edition versions 18.11 through 18.11.0 that allows authenticated users to inject unauthorized content into other users' browsers via the Mermaid sandbox component. The vulnerability requires user interaction and affects only the integrity of the application interface, not data confidentiality or system availability. GitLab addressed this issue in version 18.11.1. The vulnerability carries a CVSS 3.5 Low rating with network accessibility but requires low attack complexity and authenticated user privileges. The attack necessitates user interaction (UI:R), limiting the practical impact to client-side content injection without compromising sensitive data or system functions. This risk profile suggests minimal real-world threat severity. Exploitation status indicates no active weaponization, with the vulnerability absent from the Known Exploited Vulnerabilities (KEV) catalog and rated as inactive on threat intelligence hot lists. The EPSS score of 0.00011 reflects negligible exploitation probability among active CVEs. Limited community attention and no publicly available exploit code suggest this remains a low-priority vulnerability for most organizations, though patching to version 18.11.1 is recommended for affected deployments.