CVE-2021-39906: XSS
Published Nov 4, 2021
·Updated
Improper validation of ipynb files in GitLab CE/EE version 13.5 and above allows an attacker to execute arbitrary JavaScript code on the victim's behalf.
Affected Software
6 affected components
GitLab GitLab>=13.5.0<14.2.6
GitLab GitLab>=13.5.0<14.2.6
GitLab GitLab>=14.3.0<14.3.4
GitLab GitLab>=14.3.0<14.3.4
GitLab GitLab>=14.4.0<14.4.1
GitLab GitLab>=14.4.0<14.4.1
Event History
Nov 4, 2021
CVE Published
via MITRE·11:04 PM
Data Sourced
via MITRE·11:04 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2021-39906?
CVE-2021-39906 has a high severity rating due to its potential for executing arbitrary JavaScript code.
2
How do I fix CVE-2021-39906?
To fix CVE-2021-39906, update GitLab to the latest version that is above 14.4.1.
3
What versions of GitLab are affected by CVE-2021-39906?
GitLab versions from 13.5.0 up to 14.4.1 are affected by CVE-2021-39906.
4
What type of attacks can CVE-2021-39906 facilitate?
CVE-2021-39906 can facilitate attacks allowing execution of arbitrary JavaScript on behalf of the victim.
5
Is there a workaround for CVE-2021-39906 if I cannot update immediately?
There is no official workaround for CVE-2021-39906, so it is recommended to apply the update as soon as possible.