CVE-2021-22196: 
GitLab vulnerability analysis and mitigation

An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.4. It was possible to exploit a stored cross-site-scripting in merge request via a specifically crafted branch name (NVD, GitLab Release).

The vulnerability is classified as a medium severity issue with a CVSS v3.1 base score of 5.4 (MEDIUM). The vulnerability vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, indicating network accessibility, low attack complexity, required low privileges, and user interaction. The vulnerability is categorized as CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting) (NVD).

The vulnerability allows attackers to execute stored cross-site scripting attacks through merge requests, potentially enabling the execution of arbitrary actions on behalf of victims via the GitLab API. The attack can occur automatically without requiring victim interaction, despite GitLab's Content Security Policy (CSP) (GitLab Release).

The issue has been fixed in GitLab versions 13.10.1, 13.9.5, and 13.8.7. It is strongly recommended that all installations running affected versions be upgraded to the latest version immediately (GitLab Release).