GitLab Mermaid Sandbox Cross-Site Scripting Vulnerability

A cross-site scripting vulnerability has been identified in the GitLab Mermaid sandbox UI, affecting GitLab Community Edition (CE) and Enterprise Edition (EE) versions 16.2 prior to 18.7.5, 18.8 prior to 18.8.5, and 18.9 prior to 18.9.1. Under certain circumstances, this vulnerability could have allowed an unauthenticated user to inject arbitrary scripts into the Mermaid sandbox.

Impact

Exploitation of this vulnerability could lead to cross-site scripting, allowing for the injection of malicious scripts that could be executed in the context of the user's browser.

Remediation

Users are advised to upgrade to GitLab versions 18.9.1, 18.8.5, or 18.7.5. Instructions for updating GitLab can be found on the GitLab Update page.