Input validation

An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It allows XSS issue 1 of 2. Markdown fields contain a lack of input validation and output encoding when processing KaTeX that results in a persistent XSS...

CVE-2019-6784

An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It allows XSS issue 1 of 2. Markdown fields contain a lack of input validation and output encoding when processing KaTeX that results in a persistent XSS...

CVE-2019-6784

GitLab CVE-2019-6784 affects GitLab Community and Enterprise Edition: versions before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1 are vulnerable. A persistent XSS flaw arises in Markdown processing due to lack of input validation and output encoding when KaTeX is processed. Impact is l...

CVE-2019-6784

Removed by vendor...

GitLab: Clientside resource Exhausting by exploiting gitlab math rendering

Summary based on the documentation gitlab markdown is supporting math expresion rendering using KaTex and able to run subset syntax from LaTex this could be achieved by using 2 ways in the markdown for inline and for multiline. F476662 Steps to reproduce Step-by-step guide to reproduce the issue,...

Denial Of Service (DoS)

KaTeX is vulnerable to denial of service DoS attacks. These attacks are possible by chaining multiple /sqrt statements to take up 100% CPU power...