Two days ago, Daniel LeCheminant released a blog post describing a potential cross-site scripting vulnerability in the Redcarpet Markdown library. GitLab is not affected by this vulnerability.
The vulnerability affects applications that send the HTML that is output by
the Redcarpet Markdown library directly to the user's browser.
GitLab takes the output through an extra step of HTML sanitization, which
strips out potentially dangerous code, like
onclick attributes that can
Please contact us at support at gitlab.com if you have any questions about this issue.