GitLab Security Advisory: 16.6.1, 16.5.3, 16.4.3 Patch for XSS and ReDoS Vulnerabilities

GitLab issued security releases 16.6.1, 16.5.3, and 16.4.3 on November 30, 2023, to fix two high‑severity vulnerabilities that could allow attackers to inject malicious scripts or trigger denial‑of‑service conditions via Markdown rendering, and to prevent users with the admin_group_member custom permission from adding members with higher roles.

What Happened

Both vulnerabilities were discovered in the Banzai Markdown pipeline used by GitLab’s Jira integration. The first flaw permits cross‑site scripting (XSS) and regular‑expression denial‑of‑service (ReDoS) attacks when rendering user‑supplied Markdown. The second flaw allows a user with the admin_group_member custom permission to elevate privileges by adding members with higher roles.

Impact

Attackers could execute arbitrary JavaScript in the context of any GitLab user, potentially exfiltrating data or hijacking sessions. The ReDoS flaw could exhaust server resources, leading to service degradation. The privilege escalation flaw could let a low‑privileged user gain admin rights within a group.

Affected Versions

• GitLab Community Edition (CE) 16.6.0 and earlier
• GitLab Enterprise Edition (EE) 16.6.0 and earlier

Mitigation

Upgrade to the latest security release for your supported GitLab version:

• CE/EE 16.6.1
• CE/EE 16.5.3
• CE/EE 16.4.3

All deployment types—omnibus, source, Helm—are affected. After upgrading, verify that the Banzai pipeline is running the patched version and that custom permissions are correctly configured. Monitor logs for any anomalous Markdown rendering or group membership changes.