← Back to browse · API

CVE-2021-39906

Severity
HIGH
CVSS
8.7
EPSS
0.60729
Risk score
56.06
CISA KEV
No
PoC
No
Published
2021-11-04
Modified
2024-08-04
First seen
2026-08-07
Aliases
EUVD-2021-26262, GHSA-6CXQ-RCP9-RQR8
Products
GitLab:GitLab 13.5, <14.2.6, GitLab:GitLab 14.3, <14.3.4, GitLab:GitLab 14.4, <14.4.1
Sources
euvd EUVD-2021-26262

Description

Improper validation of ipynb files in GitLab CE/EE version 13.5 and above allows an attacker to execute arbitrary JavaScript code on the victim's behalf.

References