A vulnerability in GitLab CE/EE versions from 14.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 allows an attacker to execute arbitrary JavaScript in another user's browser via a crafted URL. This occurs due to improper sanitization of user-controlled input, leading to a cross-site scripting (XSS) issue. The vulnerability has been remediated in the specified fixed versions.