The vulnerability allows an unauthenticated user to inject arbitrary JavaScript into the Mermaid sandbox UI of GitLab Community and Enterprise editions. When a victim later opens the affected UI, the injected script executes in the victim’s browser context, enabling the attacker to hijack the session, steal authentication cookies, deface the page, or run code on the client machine. The weakness is classified as CWE‑79, reflecting improper input neutralization during web page generation.

All GitLab Community Edition and Enterprise Edition releases from 16.2 through 18.9.0 that have not yet applied the corresponding patch are affected. Specifically, versions prior to 18.7.5, prior to 18.8.5, and prior to 18.9.1 are vulnerable. Any instance hosted at the time of the advisory that falls within this range requires remediation.

The CVSS score of 8.0 indicates high severity. The EPSS score of less than 1% suggests that, as of the last report, real‑world exploitation is infrequent, and the vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog. Nonetheless, because the flaw can be triggered from any network location without authentication and only requires the victim to view the vulnerable UI, the risk to end users is significant enough to warrant prompt action.