CVE-2022-0427: GitLab

High severity, CVSS 8.8. EPSS: 0.8% chance of exploitation in the next 30 days.

Missing sanitization of HTML attributes in Jupyter notebooks in all versions of GitLab CE/EE since version 14.5 allows an attacker to perform arbitrary HTTP POST requests on a user's behalf leading to potential account takeover

Affected products

• GitLab GitLab: from 14.5, before 14.5.4 (fixed in 14.5.4); from 14.6, before 14.6.4 (fixed in 14.6.4); from 14.7, before 14.7.1 (fixed in 14.7.1)

Published 2022-03-28. Last modified 2026-06-17.