GitLab Markdown JSON Table CSRF via Improper Sanitization

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.3 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an authenticated user could have induced a targeted user to perform unintended state-changing HTTP requests due to improper sanitization of user-controlled data in the Markdown JSON table renderer.

Casky was already ahead

This CVE exploits attack patterns that Casky's 323matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-78252 is a Cross-Site Request Forgery (CSRF) vulnerability affecting GitLab Community Edition and Enterprise Edition versions 15.3 through 19.3.1. The vulnerability exists in the Markdown JSON table renderer, where insufficient sanitization of user-controlled data allows authenticated attackers to craft malicious markdown content that, when viewed by a targeted user, can trigger unintended state-changing HTTP requests on their behalf. This matters because GitLab is a critical infrastructure component for development teams worldwide—successful exploitation could lead to unauthorized changes to repositories, merge requests, or project configurations. Any organization running affected GitLab versions with users who view untrusted markdown content (in issues, merge requests, or comments) faces risk of account compromise and data integrity violations.

Casky's 323 matching skills leverage Claude AI with extended reasoning to detect the attack patterns underlying this vulnerability by mapping to MITRE ATT&CK techniques TA0001 (Initial Access—specifically social engineering and trust exploitation) and TA0043 (Reconnaissance—gathering information about target systems and users). Practitioners using Casky would identify detection signals including: (1) Analysis of markdown rendering workflows that fail input validation, revealing CWE-79 (Improper Neutralization of Input During Web Page Generation) patterns; (2) Request chains showing authenticated users performing actions they didn't initiate, indicating CSRF token bypass or absence; (3) Behavioral anomalies where legitimate users trigger administrative or destructive API calls from unexpected contexts. The platform's skill coverage enables security teams to correlate sanitization gaps in user-controlled data parsing with downstream HTTP request forgery, allowing them to hunt for exploitation attempts and validate remediation across their GitLab deployments before adversaries operationalize this vector.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

323 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-78252.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-78252

Casky has 323 skills that investigate the attack patterns behind CVE-2026-78252. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn