CVE-2022-1416

Missing sanitization of data in Pipeline error messages in GitLab CE/EE affecting all versions starting from 1.0.2 before 14.8.6, all versions from 14.9.0 before 14.9.4, and all versions from 14.10.0 before 14.10.1 allows for rendering of attacker controlled HTML tags and CSS styling

• CWE-79

• https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1416.jsonThird Party Advisory
• https://gitlab.com/gitlab-org/gitlab/-/issues/342988Exploit, Issue Tracking, Technical Description, Third Party Advisory
• https://hackerone.com/reports/1362405Permissions Required, Third Party Advisory
• https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1416.jsonThird Party Advisory
• https://gitlab.com/gitlab-org/gitlab/-/issues/342988Exploit, Issue Tracking, Technical Description, Third Party Advisory
• https://hackerone.com/reports/1362405Permissions Required, Third Party Advisory

Published

May 19, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-1410OS Command Injection vulnerability in the db_optimize compon…8.8
• CVE-2022-1411Unrestructed file upload in GitHub repository yetiforcecompa…6.1
• CVE-2022-1412The Log WP_Mail WordPress plugin through 0.1 saves sent emai…7.5
• CVE-2022-1413Missing input masking in GitLab CE/EE affecting all versions…7.5
• CVE-2022-14143scale API Management 2 does not perform adequate sanitation…8.8
• CVE-2022-1415A flaw was found where some utility classes in Drools core d…8.8
• CVE-2022-1417Improper access control in GitLab CE/EE affecting all versio…4.3
• CVE-2022-1418The Social Stickers WordPress plugin through 2.2.9 does not …6.1
• CVE-2022-1419The root cause of this vulnerability is that the ioctl$DRM_I…7.8
• CVE-2022-1420Use of Out-of-range Pointer Offset in GitHub repository vim/…5.5
• CVE-2022-1421The Discy WordPress theme before 5.2 lacks CSRF checks in so…4.3
• CVE-2022-1422The Discy WordPress theme before 5.2 does not check for CSRF…6.5