CVE-2021-39946

5.4 mediumEPSS 1.0%

Medium (5.4) in gitlab gitlab. EPSS 1.0% chance of exploitation in the next 30 days.

Improper neutralization of user input in GitLab CE/EE versions 14.3 to 14.3.6, 14.4 to 14.4.4, and 14.5 to 14.5.2 allowed an attacker to exploit XSS by abusing the generation of the HTML code related to emojis

Severity

CVSS 3.1

5.4 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS: 1.0% chance of exploitation in the next 30 days; higher than 64% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2022-01-18
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

gitlab:gitlab

References

https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39946.json
https://gitlab.com/gitlab-org/gitlab/-/issues/345657
https://hackerone.com/reports/1398305
https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39946.json
https://gitlab.com/gitlab-org/gitlab/-/issues/345657

Check your stack JSON