This vulnerability arises from improper input validation in GitLab's Mermaid sandbox, enabling an authenticated user to embed malicious content that renders in another user's browser. The failure to correctly restrict rendered UI layers or frames allows the injection of unauthorized content, potentially leading to a compromised user experience. While the primary impact is the execution of unintended browser-side rendering, the effect is confined to the rendering context and does not provide direct database or system compromise.

GitLab Community Edition and Enterprise Edition are affected for all releases starting from 18.11 up to, but excluding, 18.11.1. The vulnerability applies across both web and internal API endpoints where Mermaid diagrams are processed and displayed to authenticated users.

The CVSS score of 3.5 indicates a low overall severity; the lack of an EPSS score signals no publicly available indicator of exploitation attempts, and the vulnerability is not currently listed in the CISA KEV catalog. Attackers require authenticated access and the ability to supply or modify Mermaid diagrams, so the attack vector is most plausibly limited to privileged users within the organization. Given the limited scope and the requirement for authenticated access, the likelihood of widespread exploitation is low, though the potential for internal misuse remains. The inadequacy in input validation directly contributes to a CWE-1021 condition, emphasizing a failure in anti‑tampering controls.