CVE-2021-22242 Cross-site scripting in GitLab

High 8.7 Published 25 Aug 2021 Updated 3 Aug 2024

An attacker can execute arbitrary scripts in victim browsers via stored XSS in GitLab's Mermaid markdown rendering.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2021-22242?

CVE-2021-22242 is a high-severity cross-site scripting vulnerability in Gitlab Gitlab, published on 25 Aug 2021. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

Insufficient input sanitization in Mermaid markdown in GitLab CE/EE version 11.4 and up allows an attacker to exploit a stored cross-site scripting vulnerability via a specially-crafted markdown

Weakness: CWE-79

Which versions are affected by CVE-2021-22242?

1 open source package ship an affected version, including gitlab. It affects 1 product.

Package	Affected	Fixed in
`gitlab` Bitnami	From `11.4.0`	`13.12.9, 14.0.7, 14.1.2`

Products include Gitlab Gitlab.

How do I fix CVE-2021-22242?

Upgrade gitlab to a fixed version for your release line: 13.12.9, 14.0.7 or 14.1.2.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2021-22242 being exploited?

There is no known exploitation of CVE-2021-22242 in the wild and no public exploit code.

All Gitlab Gitlab vulnerabilities

Sources

Also known as BIT-gitlab-2021-22242, GHSA-3r2f-rpgw-83gm, UBUNTU-CVE-2021-22242.