GitLab Product Security Update Advisory
Overview
We have released security updates to fix vulnerabilities in GitLab products. Users of affected products are advised to update to the latest version.
Affected Products
CVE-2026-0595
GitLab CE/EE Versions: 13.9 and above but below 18.6.6
GitLab CE/EE Versions: 18.7 and above but below 18.7.4
GitLab CE/EE versions: 18.8 and above but below 18.8.4
CVE-2025-7659
GitLab CE/EE Versions: 18.2 and later but not earlier than 18.6.6
GitLab CE/EE Version: 18.7 and later but not earlier than 18.7.4
GitLab CE/EE versions: 18.8 and above but below 18.8.4
CVE-2025-8099
GitLab CE/EE Version: 10.8 or later but not earlier than 18.6.6
GitLab CE/EE versions: 18.7 and later but not earlier than 18.7.4
GitLab CE/EE versions: 18.8 and above but below 18.8.4
CVE-2026-0958
GitLab CE/EE Version: 18.4 or later but not earlier than 18.6.6
GitLab CE/EE Version: 18.7 and later but not earlier than 18.7.4
GitLab CE/EE Version: 18.8 and above but below 18.8.4
CVE-2025-14560
GitLab CE/EE version: 17.1 or later but not earlier than 18.6.6
GitLab CE/EE version: 18.7 or later but not earlier than 18.7.4
GitLab CE/EE version: 18.8 or later but not earlier than 18.8.4
Resolved Vulnerabilities
HTML injection vulnerability in test case titles in GitLab CE/EE (CVE-2026-0595)
Under-validation vulnerability in the Web IDE in GitLab CE/EE (CVE-2025-7659)
Denial of Service Vulnerability in GraphQL Introspection in GitLab CE/EE (CVE-2025-8099)
Denial of Service Vulnerability in JSON Validation Middleware in GitLab CE/EE (CVE-2026-0958)
Cross-site scripting vulnerability in code flow in GitLab CE/EE (CVE-2025-14560)
Vulnerability Patches
Vulnerability patches have been made available in the latest updates. Please follow the instructions on the Referenced Sites to update to the latest Vulnerability Patches version.
CVE-2026-0595, CVE-2025-7659, CVE-2025-8099, CVE-2026-0958, CVE-2025-14560
GitLab CE/EE version: 18.6.6
GitLab CE/EE version: 18.7.4
GitLab CE/EE version: 18.8.4
References
[1] GitLab Patch Release: 18.8.4, 18.7.4, 18.6.6
https://about.gitlab.com/releases/2026/02/10/patch-release-gitlab-18-8-4-released/