CVE-2020-13321: 
GitLab vulnerability analysis and mitigation

A vulnerability was discovered in GitLab affecting all versions prior to 13.1, identified as CVE-2020-13321. The vulnerability allowed users to bypass username format restrictions, enabling the addition of HTML tags in usernames (NVD, GitLab Release).

The vulnerability stemmed from an improper sanitization of username inputs where the system's sanitize method would ultimately call html_safe, allowing certain HTML tags to be rendered instead of being treated as plain text. This specifically occurred in the shared notes view where user names were being processed (GitLab Issue).

The vulnerability could be exploited to create misleading usernames containing HTML elements, including clickable links and images. This could be used for phishing attacks by redirecting users to malicious sites when they click on a username, or by adding deceptive visual elements like fake 'VIP' badges (GitLab Issue).

The vulnerability could be exploited by setting a username containing specific HTML tags, particularly using the <a href> tag with carefully crafted URLs. Attackers could bypass certain restrictions by using backslashes instead of forward slashes in URLs. The exploit could be used in conjunction with GitLab's snippet feature to create convincing phishing scenarios (GitLab Issue).

The vulnerability was patched in GitLab version 13.1.2, 13.0.8, and 12.10.13. GitLab strongly recommended that all installations running affected versions be upgraded to the latest version immediately. The fix involved modifying how user names are rendered to prevent HTML interpretation (GitLab Release).