vulnerability

Gitlab Gitlab: CVE-2021-22242: Improper Neutralization of Input During Web Page Generation

Try Surface Command

Back to search

Severity

CVSS

(AV:N/AC:M/Au:S/C:N/I:P/A:N)

Published

Aug 25, 2021

Added

Apr 22, 2025

Modified

Mar 25, 2026

Description

Insufficient input sanitization in Mermaid markdown in GitLab CE/EE version 11.4 and up allows an attacker to exploit a stored cross-site scripting vulnerability via a specially-crafted markdown

Solution

gitlab-gitlab-upgrade-latest

References

CWE-79
CVE-2021-22242
https://attackerkb.com/topics/CVE-2021-22242
https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22242.json
https://gitlab.com/gitlab-org/gitlab/-/issues/332528
https://hackerone.com/reports/1212822
https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-9388

Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.

Get report