CVE-2021-22199: 
GitLab vulnerability analysis and mitigation

A stored Cross-Site Scripting (XSS) vulnerability was discovered in GitLab (CVE-2021-22199) affecting all versions starting from 12.9. The vulnerability was specifically related to the use of scoped labels in GitLab's interface. The issue was initially reported on December 3, 2020, and was publicly disclosed in early 2021 (GitLab Issue, CVE Details).

The vulnerability allowed for the injection of arbitrary JavaScript code into markdown using the scoped label description. The exploit was confirmed to work on gitlab.com using Firefox (version 83.0), self-hosted GitLab instances without Content Security Policy (CSP) using Safari (version 13.1), and Chrome for Android (version 86.0.4240.198). The vulnerability received a CVSS v3.1 score of 10.0 (CRITICAL) (NVD Results).

The vulnerability allowed attackers to perform any action within the application that a legitimate user could perform, including stealing sensitive user data and credentials. The attack vector involved creating a public project, establishing a label with the XSS payload, and adding the malicious label to issue comments across multiple public projects (GitLab Issue).

The vulnerability was fixed in subsequent GitLab releases. Debian's security tracker indicates that the issue was resolved in version 17.3.5-3 for the sid release (Debian Tracker).