CVE-2021-39908: 
GitLab vulnerability analysis and mitigation

In all versions of GitLab CE/EE starting from 0.8.0 before 14.2.6, all versions starting from 14.3 before 14.3.4, and all versions starting from 14.4 before 14.4.1, certain Unicode characters can be abused to commit malicious code into projects without being noticed in merge request or source code viewer UI. This vulnerability is also known as a "Trojan Source Attack" (GitLab Security Release).

The vulnerability is classified as a medium severity issue with a CVSS v3.1 base score of 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N). The vulnerability is related to code injection (CWE-94) where attackers can abuse certain Unicode characters to hide malicious code that won't be visible in the merge request or source code viewer interface (NVD).

The vulnerability allows attackers to commit malicious code into projects without it being noticed during code review processes, as the malicious code remains hidden in the merge request or source code viewer UI. This could lead to the introduction of unauthorized code changes that bypass normal code review procedures (GitLab Security Release).

GitLab has addressed this vulnerability in versions 14.4.1, 14.3.4, and 14.2.6. Users are strongly recommended to upgrade to one of these patched versions immediately to mitigate the risk (GitLab Security Release).