CVE-2021-39946

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Improper neutralization of user input in GitLab CE/EE versions 14.3 to 14.3.6, 14.4 to 14.4.4, and 14.5 to 14.5.2 allowed an attacker to exploit XSS by abusing the generation of the HTML code related to emojis

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
GitLab	GitLab	>=14.3, <14.3.6; >=14.4, <14.4.4; >=14.5, <14.5.2

References

https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39946.jsonVendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/345657Broken Link, Vendor Advisory
https://hackerone.com/reports/1398305Permissions Required, Third Party Advisory
https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39946.jsonVendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/345657Broken Link, Vendor Advisory
https://hackerone.com/reports/1398305Permissions Required, Third Party Advisory

Timeline

Published: Jan 18, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-399477.5In specific circumstances, trace file buffers in GitLab Runner versions up to 14.3.4, 14.4 to 14.4.2, and 14.5 to 14.5.2 would re-use the fi CVE-2021-39955.5A logic error was found in the libmount library of util-linux in the function that allows an unprivileged user to unmount a FUSE filesystem.CVE-2021-39965.5A logic error was found in the libmount library of util-linux in the function that allows an unprivileged user to unmount a FUSE filesystem.CVE-2021-399667.5There is an Uninitialized AOD driver structure in Smartphones.Successful exploitation of this vulnerability may affect service confidentiali CVE-2021-399677.5There is a Vulnerability of obtaining broadcast information improperly due to improper broadcast permission settings in Smartphones.Successf CVE-2021-399687.5Changlian Blocklist has a Business Logic Errors vulnerability .Successful exploitation of this vulnerability may expand the attack surface o CVE-2021-399697.5There is an Unauthorized file access vulnerability in Smartphones.Successful exploitation of this vulnerability may affect service confident CVE-2021-39975.5A flaw was found in systemd. An uncontrolled recursion in systemd-tmpfiles may lead to a denial of service at boot time when too many nested CVE-2021-399707.5HwPCAssistant has a Improper Input Validation vulnerability.Successful exploitation of this vulnerability may create any file with the syste CVE-2021-399717.5Password vault has a External Control of System or Configuration Setting vulnerability.Successful exploitation of this vulnerability could c CVE-2021-399727.5MyHuawei-App has a Exposure of Sensitive Information to an Unauthorized Actor vulnerability.Successful exploitation of this vulnerability co CVE-2021-399737.5There is a Null pointer dereference in Smartphones.Successful exploitation of this vulnerability may cause the kernel to break down.