Loading vulnerability…
Client-side DoS via Malicious Mermaid Diagram in GitLab EE
A vulnerability in GitLab EE (versions 10.5 before 16.4.3, 16.5 before 16.5.3, and 16.6 before 16.6.1) allows an attacker to trigger a client-side denial of service by submitting specially crafted Mermaid diagram input. The vulnerability arises from improper handling or validation of user-supplied diagram data, which can cause excessive resource consumption or browser crashes when rendered on the client side.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows an attacker to disrupt the availability of the GitLab web interface for users viewing the malicious Mermaid diagram, potentially causing browser crashes or unresponsiveness. This does not impact server-side availability or compromise data integrity or confidentiality.
If you can’t patch tonight, do this now.
Restrict the ability to submit or render Mermaid diagrams from untrusted users until the patch can be applied. Consider disabling the Mermaid diagram feature if feasible as a temporary measure.
Patch, then assume compromise.
Upgrade GitLab EE to version 16.4.3, 16.5.3, or 16.6.1 or later, which contain the fix for this vulnerability.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.