MEDIUM

CVE-2021-22242

Gitlab GitLab 2021-08-25 CVSS v3.1

CVSS

5.4

Description

Insufficient input sanitization in Mermaid markdown in GitLab CE/EE version 11.4 and up allows an attacker to exploit a stored cross-site scripting vulnerability via a specially-crafted markdown

Summary dbcve.org

A stored cross-site scripting (XSS) vulnerability exists in GitLab CE/EE due to insufficient input sanitization of Mermaid markdown. Attackers can inject malicious JavaScript via specially-crafted markdown that gets rendered in the Mermaid diagram component, allowing script execution in the context of other users viewing the content.

Mitigation

Upgrade to the patched GitLab version or implement output encoding/sanitization specifically for Mermaid markdown rendering to strip malicious script payloads before display.

Weakness (CWE)

CWE-79 Cross-site Scripting (XSS)

EPSS Score

63.56%

Probability of exploitation in next 30 days

99.2th percentile

References

https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22242.json Vendor Advisory https://gitlab.com/gitlab-org/gitlab/-/issues/332528 Broken Link https://hackerone.com/reports/1212822 Permissions Required, Third Party Advisory

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE