CVE-2021-22242

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Insufficient input sanitization in Mermaid markdown in GitLab CE/EE version 11.4 and up allows an attacker to exploit a stored cross-site scripting vulnerability via a specially-crafted markdown

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
GitLabGitLab>=11.4, <13.12.9; >=14.0, <14.0.7; >=14.1, <14.1.2

References

Timeline

Published
Aug 25, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-222434.3Under specialized conditions, GitLab CE/EE versions starting 7.10 may allow existing GitLab users to use an invite URL meant for another emaCVE-2021-222446.5Improper authorization in the vulnerability report feature in GitLab EE affecting all versions since 13.1 allowed a reporter to access vulneCVE-2021-222452.7Improper validation of commit author in GitLab CE/EE affecting all versions allowed an attacker to make several pages in a project impossiblCVE-2021-222466.5A vulnerability was discovered in GitLab versions before 14.0.2, 13.12.6, 13.11.6. GitLab Webhook feature could be abused to perform denial CVE-2021-222474.3Improper authorization in GitLab CE/EE affecting all versions since 13.0 allows guests in private projects to view CI/CD analyticsCVE-2021-222485.3Improper authorization on the pipelines page in GitLab CE/EE affecting all versions since 13.12 allowed unauthorized users to view some pipeCVE-2021-222494.3A verbose error message in GitLab EE affecting all versions since 12.2 could disclose the private email address of a user invited to a groupCVE-2021-22258.1Vulnerability in the Oracle E-Business Intelligence product of Oracle E-Business Suite (component: DBI Setups). Supported versions that are CVE-2021-222505.4Improper authorization in GitLab CE/EE affecting all versions since 13.3 allowed users to view and delete impersonation tokens that administCVE-2021-222514.3Improper validation of invited users' email address in GitLab EE affecting all versions since 12.2 allowed projects to add members with emaiCVE-2021-222526.5A confusion between tag and branch names in GitLab CE/EE affecting all versions since 13.7 allowed a Developer to access protected CI variabCVE-2021-222535.4Improper authorization in GitLab EE affecting all versions since 13.4 allowed a user who previously had the necessary access to trigger depl
CVE-2021-22242: Medium severity, CVSS 5.4 | Vulnix