AVID-2026-R0885

Description

Vulnerability CVE-2021-39906

Details

Improper validation of ipynb files in GitLab CE/EE version 13.5 and above allows an attacker to execute arbitrary JavaScript code on the victim’s behalf.

Reason for inclusion in AVID: The CVE describes a security vulnerability in GitLab that allows executing arbitrary JavaScript via ipynb files. GitLab is widely used in ML pipelines and AI workflows (notebooks, CI/CD), so this affects software used to build/deploy AI systems. It is a security/safety vulnerability with potential impact to data integrity/confidentiality. The description provides sufficient signal (CVE id, affected versions, CVSS). Therefore it should be kept for AVID curation under AI supply chain scope.

References

Affected or Relevant Artifacts

Developer: GitLab
Deployer: GitLab
Artifact Details:

Type	Name
System	GitLab

Impact

AVID Taxonomy Categorization

Risk domains: Security
SEP subcategories: S0100: Software Vulnerability
Lifecycle stages: L06: Deployment

CVSS

Version	3.1
Vector String	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Base Score	8.7
Base Severity	🔴 High
Attack Vector	NETWORK
Attack Complexity	🟢 Low
Privileges Required	🟢 Low
User Interaction	REQUIRED
Scope	CHANGED
Confidentiality Impact	🔴 High
Integrity Impact	🔴 High
Availability Impact	NONE

Other information

Report Type: Advisory
Credits:
Date Reported: 2021-11-04
Version: 0.3.3
AVID Entry