CVE-2021-39946

MEDIUM 5.4CVE-2021-39946 · Published 18/01/2022 · updated 17/06/2026

In short

CVE-2021-39946 is a MEDIUM (CVSS 5.4) vulnerability affecting gitlab (gitlab).
Chance of exploitation in the next 30 days (EPSS): 1.0%, higher than 64.2% of all vulnerabilities.
Fix: update to 14.3.6, 14.4.4, 14.5.2 or later.

Package	Affected versions	Patched versions
gitlab gitlab	`≥ 14.3, < 14.3.6≥ 14.4, < 14.4.4≥ 14.5, < 14.5.2`	`14.3.614.4.414.5.2`

Description

Improper neutralization of user input in GitLab CE/EE versions 14.3 to 14.3.6, 14.4 to 14.4.4, and 14.5 to 14.5.2 allowed an attacker to exploit XSS by abusing the generation of the HTML code related to emojis

References

gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39946.json · Vendor Advisory
gitlab.com/gitlab-org/gitlab/-/issues/345657 · Broken Link
hackerone.com/reports/1398305 · Permissions Required

More vulnerabilities in gitlab

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

gitlab

≥ 14.3, < 14.3.6≥ 14.4, < 14.4.4≥ 14.5, < 14.5.2

14.3.614.4.414.5.2

More vulnerabilities in gitlab

See all →