CVE-2021-22227: 
GitLab vulnerability analysis and mitigation

A reflected cross-site scripting (XSS) vulnerability was identified in GitLab versions before 13.11.6, 13.12.6, and 14.0.2. The vulnerability was discovered on March 30, 2020, and was assigned CVE-2021-22227. This security flaw affected the GitLab release edit functionality, specifically related to the back_url parameter (GitLab Issue).

The vulnerability existed in the release edit URLs where an attacker could inject malicious JavaScript code through the back_url parameter. When a user with release edit permissions clicked the Cancel button on the affected page, the malicious code would execute. While the execution was prevented on gitlab.com due to Content Security Policy (CSP), the vulnerability could potentially be exploited on instances with different security configurations (GitLab Issue).

If successfully exploited, this vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of other users' browsers, potentially leading to account compromise, data theft, or other malicious actions. The vulnerability could also be used as a vector for open redirect attacks (GitLab Issue).

The vulnerability was patched in GitLab versions 13.11.6, 13.12.6, and 14.0.2. Users are advised to upgrade to these versions or later to protect against this security issue (Debian Tracker).