← All credits

Thanks @saleemrashid for reporting this vulnerability through our HackerOne bug bounty program

2 vulnerability records and advisories credit this contributor.

Improper validation of ipynb files in GitLab CE/EE version 13.5 and above allows an attacker to execute arbitrary JavaScript code on the victim's behalf.

Insufficient input sanitization in Mermaid markdown in GitLab CE/EE version 11.4 and up allows an attacker to exploit a stored cross-site scripting vulnerability via a specially-crafted markdown