CVE-2021-22220: 
GitLab vulnerability analysis and mitigation

A stored Cross-Site Scripting (XSS) vulnerability was discovered in GitLab affecting all versions starting with 13.10. The vulnerability was specifically found in the blob viewer component when displaying notebooks (GitLab Security, CVE Mitre).

The vulnerability arose from GitLab's use of DOMPurify for data sanitization, which by default allows data-* attributes. When combined with rails-ujs, these attributes could be exploited to execute arbitrary JavaScript code. The vulnerability was assigned a medium severity rating with a CVSS score of 6.1 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) (GitLab Security).

When exploited, the vulnerability allowed attackers to execute arbitrary JavaScript code when victims clicked anywhere on the notebook viewer screen. Since GitLab allows sending API requests via JavaScript in web browsers, attackers could potentially perform unauthorized actions on behalf of victims, including escalating permissions and accessing private objects (GitLab Issue).

The vulnerability was patched in GitLab versions 13.12.2, 13.11.5, and 13.10.5. GitLab strongly recommended that all installations running affected versions be upgraded to the latest version immediately (GitLab Security).