CVE-2021-22242: GitLab Mermaid markdown stored XSS via insufficient input sanitization

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityStored XSS in a widely deployed collaboration platform with a high EPSS score and low-privilege, network-reachable attack path warrants prompt patching despite the medium CVSS base score.

What it is

GitLab CE/EE version 11.4 and up fails to properly sanitize input in Mermaid markdown, allowing a stored cross-site scripting payload to be embedded in markdown content. Because the payload is stored and rendered to other users, it can execute in their browsers when they view the affected content. The record does not specify the exact fixed version or a full affected version range beyond '11.4 and up'.

Impact

An attacker can execute arbitrary script in the browser of a victim who views the crafted markdown, potentially stealing session tokens or acting as the victim within GitLab. The CVSS scope change (S:C) indicates the impact can extend beyond the vulnerable component.

Attack surface

Reached over the network by submitting specially crafted Mermaid markdown that is later rendered to other users. The vector requires low privileges (PR:L) and user interaction (UI:R), so the attacker needs an authenticated account and the victim must view the crafted content.

Exploitation

Not listed in CISA KEV and no public exploit reference is tagged in the record, but EPSS is high at 0.63555 (99.2nd percentile), indicating elevated likelihood of exploitation activity.

What to do

• Upgrade GitLab CE/EE to a version that includes the fix for CVE-2021-22242; consult the vendor advisory for the exact patched release.
• If immediate upgrade is not possible, restrict or disable Mermaid rendering in markdown where feasible.
• Limit who can create or edit markdown content that renders Mermaid diagrams.
• Apply input sanitization or content security policy controls to reduce script execution in rendered markdown.

Detection

• Search GitLab markdown content and repository files for Mermaid blocks containing script tags, event handlers, or javascript: URIs.
• Monitor GitLab application logs for suspicious markdown submissions or edits by low-privileged users.
• Review browser or proxy logs for script execution or outbound requests originating from GitLab pages rendering Mermaid content.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.