CVE-2020-26409: 
GitLab vulnerability analysis and mitigation

A Denial of Service (DOS) vulnerability was identified in GitLab CE/EE versions >=10.3 and <13.6.2 (including <13.4.7 and <13.5.5). The vulnerability allows attackers to trigger uncontrolled resource consumption by bypassing input validation in markdown fields (GitLab Release, NVD).

The vulnerability, tracked as CVE-2020-26409, is related to the Mermaid functionality in markdown fields. It represents a bypass of previous mitigations implemented for similar vulnerabilities (CVE-2019-9220 and CVE-2019-15584). The vulnerability has been assigned a CVSS v3.1 base score of 4.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L (NVD).

When exploited, the vulnerability can cause browser tabs displaying affected pages to freeze, preventing browsing and editing of pages containing the malicious Mermaid graphs. The resource consumption increases as rendering continues, potentially leading to browser crashes. This affects all pages using Markdown with Mermaid functionality (GitLab Issue).

The vulnerability has been patched in GitLab versions 13.6.2, 13.5.5, and 13.4.7. Organizations are strongly recommended to upgrade to these or later versions immediately to mitigate the risk (GitLab Release).